International data transfers have been at the forefront of GDPR recently. Following Brexit, the UK has adopted similar GDPR principles to its former EU GDPR guidelines to ensure that the security of data remains a priority.
UK businesses that operate on a global scale are expected to feel the impact of these heightened new guidelines, and of course, compliance is critical to the smooth running of business as usual.
GDPR itself remains the core guiding principle to the handling of data on behalf of others. With the purpose of protecting the integrity of data by setting out laws, GDPR ensures citizens are aware of how their data is being used, how long it is held for and that it remains confidential.
What are the key differences to international data transfer regulations?
Zunoma prioritises the security and integrity of personal and private data, GDPR is one of the core guiding principles in our strategic objectives and ensures we are acting in line with regulations to protect our customers from data vulnerabilities.
UK GDPR will predominantly apply to UK based processors and controllers. Companies on a global scale will be affected by international data transfer regulations and changes to GDPR through the necessary requirements to proceed in data exchanges with countries that have been deemed adequate and restrict transfers to those that are deemed ‘non-adequate’.
Adequate and non-adequate countries are decided on the basis of their ability to ensure an appropriate level of data protection under the European Economic Area (EEA) regulations. A transfer to an adequate country does not require permissions from supervisory authorities, however, a transfer to a non-adequate country requires appropriate safeguards to be in place to ensure GDPR protection is not undermined.
Binding Corporate Rules (BCRs) have also been adopted as a statutory recognition, demonstrating specific content requirements as a safeguarding measure. Without the requirement for additional approvals, data transfers should remain more streamlined.
One of the biggest components of changes to international data transfers and their compliance, is the associated costs for obtaining approval permissions. In order for corporate groups to meet compliance requirements, there are timely and costly procedures to follow, with audits and training for the handling of personal data. This process ensures the data is legally permitted for transfer under GDPR and is being handled in line with the appropriate regulations.
Standard Model Clauses are also widely used in the transfer of data on an international scale. As key contracts approved by the European Commission for the transfer of data outside of the EEA, they are recognised as approved safeguard measures for adequate transfers and bypass the requirement to obtain additional permissions.
Overall, the impacts of these changes are thought to be positive, with a number of solutions available for the continued safeguarding of private and protected information.
BCRs and Standard Model Clauses will remain the most frequently used safeguards, in addition to a host of other standard GDPR solutions.
Some of these solutions include:
- Approved code of conduct – Dictates how the code of conduct is applied to personal data transfers on an international scale.
- Approved certification mechanisms – A certification procedure that includes data protection seals and marks to demonstrate security and additional binding enforceable agreements surrounding the sharing of secure data.
- Ad-hoc contracts (Derogations) – This stipulates that, when necessary, a contractual agreement should be approved by a supervisory authority. However, this will depend on the necessity of the international data transfer on a legal basis.
Compliance with these principles is imperative to a successful data protection practice. Failure to comply leads to substantial fines.
In what ways do Zunoma prioritise the compliance of GDPR for customers protected data?
As a security printing service provider, we take GDPR very seriously. Our core values are centred around data and document security, with over 75 years of experience protecting and maintaining the authenticity of customer PPI.
A number of our processes ensure that the threat of identity fraud is minimised by prioritising up to date GDPR and safeguarding regulations. To support the implementation of such regulations, IT qualifications for GDPR are covered by our ISO 27001 & Cyber Essential accreditations.
As data processors trusted worldwide, we have obligations to monitor compliance with GDPR across all of our departments. We implement appropriate technical and organisational measures to ensure a level of security applicable to the risk. In addition, we prepare for any significant changes that GDPR brings to the print industry, making sure we develop a systematic approach for the safety of your business information.
As a trusted partner of worldwide institutions, we use unique delivery solutions that enable people and businesses to participate in the global marketplace with the assurance that their private data is secure.
Contact us now to discuss what we can do for you.
List of resources:
- https://www.lexology.com/library/detail.aspx?g=d01875d2-1c5b-4d6b-93fd-eabbd6d660ff
- https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/
- https://ico.org.uk/for-organisations/guide-to-data-protection/key-dp-themes/
- https://www2.deloitte.com/ch/en/pages/risk/articles/gdpr-the-future-of-international-data-transfer.html
- https://www.computerweekly.com/podcast/Printing-document-capture-and-compliance-risk-in-the-GDPR-era