Data Security, Transfer and Deletion

Why is personal data security important?

Privacy laws require that a company keeps personal data always secure by implementing the best in class and pragmatic measures based on the risk of processing. These measures are often referred to as Technical and Organisational measures or TOMs. Implementation of TOMs is important because it helps to ensure that personal data stays secure and that only authorised persons have access to it for the right reason.

What are the two common roles under privacy law?

1. Controller - the company that decides to collect and decide on the  purposes of processing
2. Processor - the company hired by a controller to process personal data on their behalf

It is possible to have relations like controller-controller when both companies independently decide upon purpose and collection of personal data. There is a joint controller when both companies jointly decide upon purpose and collection of personal data and there is a sub-processor when the processor hires another company for the processing of personal data on behalf of the controller.

When can a company transfer personal data?

GDPR requires companies exchanging personal data to ensure proper security of personal data at all times.

There can be a few scenarios where this is possible:

• Firstly, the transfer between companies in the same jurisdiction i.e. same laws are applicable to both companies
• Secondly, transfer to companies that are not in the same jurisdiction i.e. data is being processed by a company that has different applicable privacy laws

If personal data is to be transferred to a country not in an adequacy list, the controller must assess and ensure adequate safeguards. This can be ensured by:

1. Usage of Standard Contractual Clauses (SCCs) - set of contractual clauses that are recommended by the European Commission for inclusion in contracts when personal data is being transferred.
2. Usage of Binding Corporate Rules (BCRs) - data protection policies adhered to by companies established in the EU for transfers of personal data outside the EU within a consolidated group of companies.