In short
Three reasons transfers still get checked
- Customer opinion: they expect a warranty and the right clauses
- Due diligence: transfers are reviewed in any audit or investment
- Regulator interest: an unaddressed transfer aggravates any breach
There are (at least) three good reasons to act now to make sure your company’s transfers of personal data are in line with the applicable requirements:
- Customer opinion: Customers are aware of the requirements and will expect you to warrant that your international transfers are compliant. Frankly, customers will also expect you to be able to include the correct clauses in your contracts.
- Due diligence: International transfers of personal data will be reviewed as part of any audit or due diligence process so will certainly be relevant for companies seeking investment.
- Regulator interest: International transfers of data are a hot topic, and a transfer that has not been addressed properly could be seen as an aggravating factor in the event of a regulatory breach.
Clarity now after a period of uncertainty
If your business transfers personal data collected in the UK and Europe to other countries such as the US, you may have been watching the many changes in the laws following the decision in Schrems II in the summer of 2020.
The good news is that after a long period of uncertainty around international transfers, we now have new standard contract clauses published by both the EU and the UK, plus clarity around how to analyse and document the security of the data being transferred in transfer impact assessments. So now is a great time to put your house in order.
What needs to be done
To summarise the process, companies need to review their flows of personal data to identify transfers of data collected from the UK and Europe to other territories. For those transfers, the right transfer mechanism needs to be identified (which is usually reliance on standard contract clauses). The next step is to dig out and update the relevant contracts, run transfer impact assessments, and document and review this process.
How we can help:
We are data protection and privacy experts with years of experience working for multinationals. Our years of in-house experience mean that we give clear advice and practical solutions. We won’t trouble you with the ins and outs of the law (even though we secretly love that). We take the pain out of privacy compliance for our clients.
Contact us for a free and confidential consultation on how we can best help you.