Your international expansion could be putting personal data at risk

In a rapidly expanding world, personal data inevitably moves and is shared across borders which is particularly relevant for global entities, expanding entities or those wanting to target specific jurisdictions. It can be a complex area to navigate as it is not just about compliance, it is a strategic risk and governance issue.

Data protection needs to be built into expansion planning which in turn enables informed decision making. The first step is understanding your data landscape, what personal data your organisation is processing and what legislation it needs to comply with. A data mapping exercise can help to simplify this by detailing how your organisation is structured globally, for example where subsidiaries/branches are based, whether they are separate legal entities, what personal data may flow to and from those entities, how that personal data may be transferred and what data protection legislation may be applicable such as UK GDPR.

Expanding from the UK

As you expand your business beyond the UK, it is likely that personal data will move with that, either between offices/entities/branches or to separate legal entities.

To determine whether a transfer of personal data is a ‘restricted transfer’, and when the rules of international transfers apply, then you need to consider whether you are in scope of UK GDPR, whether you are initiating the transfer to an organisation based outside the UK and whether the organisation receiving the personal data is a separate legal entity to you. It will not be a ‘restricted transfer’, for example, if one of your staff is working outside the UK (because you and your staff member are part of the same legal entity), but it will be if you use self-employed contractors based in another country for example. The ICO highlights in its guidance that ‘transfer’ refers to both sending personal data to a separate organisation outside the UK; and making personal data accessible to a separate organisation outside the UK, for example, by giving access to your systems.

If any transfers of personal data are restricted transfers then you not only need to comply with the transfer requirements, you also need to comply with the wider requirements of the UK GDPR which include, amongst other things, ensuring there is appropriate and adequate security in place (particularly relevant when considering the geographical location of any receiver’s processing).

GDPR: Expanding into the UK/EU

You will be in scope of UK GDPR or EU GDPR if you are offering goods or services to customers/clients/consumers in the UK or the EU regardless of whether a payment is required; and/or you are monitoring the behaviour of individuals within the UK or the EU. This might be a website or an app which is accessible to individuals within the UK or EU and the platform on which you are offering goods or services.

If you are in scope, you will need to comply with the requirements of the UK GDPR/EU GDPR and any associated marketing/cookies legislation. You will also need to consider whether you need to have a representative in place, if you do not have an establishment in the UK or the EU.

How Moore Kingston Smith can help

International transfers are one of the more complex parts of data protection legislation but also one of the most critical for growing organisations. Addressing these challenges will ensure lawful processing and sharing of personal data across borders but will also enable compliant scalable international growth, promoting responsible data handling across all markets.

For further support and guidance, contact our Data protection advisory team: DPadvisory@mks.co.uk