Cross border data transfers are common and can occur in different business functions such as marketing, payroll or IT. Plenty of our clients use external offshore companies to assist in providing technical support or development work, for example, developers in Romania or technical support teams in India.
The process of transferring data to different countries can often become complex (consider what happens if data is shipped from one country to another, and then another). To maintain your compliance with UK GDPR, our team of helpful data protection and privacy solicitors can help, making sure you have robust agreements and have taken suitable risk assessments.
In this article we review some of the things you should look out for to ensure compliance.
Sharing data with offshore providers
How should businesses identify what they need and who’s responsible for what?
Each business is different. Requirements vary based on your business model; what your business can afford; what expertise it requires; and whether the service provider of your choice can provide you the service with optimal security. Although, the ultimate deal breaker - is usually cost.
In order to understand what your responsibilities are, it’s important to recognise yourself as which one of the two roles you are, involving data processing.
The first role is of the data controller; this is the organisation that determines the reason for processing data, the second, if you are actually processing the data on behalf of the controller, then you are likely to be a data processor. A service provider acting on instructions of the client controller, is likely to fall into the latter category.
As a controller, you are responsible for ensuring your processing, including that of the processing conducted on your behalf, complies with the General Data Protection Regulation (UK GDPR).
So, in essence, not only are you; the controller, accountable for your own compliance, but also the compliance of your processors. It’s, therefore, necessary that you choose a processor that provides sufficient guarantees that they will implement appropriate technical and organisational measures to ensure their processing meets UK GDPR requirements.
Organisations should understand that regardless of where the service provider is located, the UK GDPR extends to third countries in the following scenarios:
- processing personal data outside the EU or UK by controllers or processors established in the EU, regardless of whether the actual processing takes place in the EU or UK;
- processing personal data of EU or UK data subjects by non-EU/UK controllers or processors, where the processing activities are related to the offering of goods or services or the monitoring of behaviour
Your Information Security function would be a key player in deciding whether the chosen service provider can provide you with what your business needs to keep data safe. It’s therefore necessary to explicitly state what your processors’ obligations are, in line with article 28 of the GDPR, which states the Controller must impose to its’ Processor a list of obligations, such as imposing technical and organisational procedures on the processor, as well as only following the instructions of the controller.
What are the necessary safeguards and when are they used?
Once caught by the UK GDPR, offshore providers must ensure compliance with rights and obligations created under the GDPR regime, the most important being:
- The Data Processing Agreement - ensuring there is a contract between your organisation (controller) and the service provider (processor);
- Cross border transfers - Risk assessments need conducting prior to any transfer of personal data cross border to non-adequate countries. It’s not always the case that processors are based in the EEA or the UK, many service providers are based across the waters such as in the US. It is necessary to ensure you have adequate safeguards in place to be able to transfer personal data to your processor cross border. Data transfers to certain third countries which are considered adequate are permissible without any further safeguards. However, transfers to other third countries are permitted so long as one of the transfer mechanisms in Chapter 5 of the GDPR is met. One of those is signing and complying with standard contractual clauses (SCCs), the UK has its own version referred to as the International Data Transfer Agreement (IDTA) as do other countries, inspired by the EU SCCs; the version you agree would be dependent on where the personal data and of whom, is being transferred. The following are risk assessments that need considering: -
- Data Protection Impact Assessments (DPIA) - where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, a controller must carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.
- Transfer Impact Assessment or Transfer Risk assessment - this enables data exporters (controllers) to determine if the mechanism they intend to use for an international data transfer provides an adequate level of protection in the circumstances of that transfer.
- Security of processing – you need to ensure that you implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
Some examples of Processors
- Payroll provider – to assist aspects of payroll on behalf of a controller;
- Market research companies- that collect and analyse, and share data under the instructions of a controller;
- IT service providers;
- Software as a Service (SaaS) providers;
- IT consulting companies; and
- More generally, it’s any organisation that provides a service which requires personal data to be processed on behalf of a controller.
Data processing agreements are carefully drafted documents and it’s important to get them right. It can sometimes be the case, that a service provider is not a processor but either a joint or independent controller. Our specialist data protection solicitors can assist in assessing what role you or the service provider plays, as well as the actual risk against the nature and purpose of processing and provide specific advice in how to deal with any risk. We can then assist in drafting bespoke data processing agreements that fall out of the normal article 28 GDPR (controller to processor) relationship.
At times, large corporate companies have internal support functions that provide 'processor' level support or require the need of personal data in being transferred for business purposes, our data protection specialists can assist in drafting inter-affiliate data transfer agreements so that internal transfers are compliant and in line with global data privacy laws.
