We provide services for Enterprise, SME, schools and Charity organisations. Whether you need a global data audit or targeted help in a specific geography or function, Securys will work with you to embed data privacy across your organisation.
International Data Transfers
We provide a comprehensive service that ensures data subject rights are protected whilst keeping data flowing and risks minimised.
Whether you have direct operations abroad, contract with third-party providers or merely use cloud services or internet advertising, almost all businesses transfer personal data internationally.
The laws and regulations governing these transfers are constantly changing. It's not just about the GDPR and flows between Europe and the US; more than 130 countries have data protection rules that apply to transfers.
You need to understand how data flows around your enterprise and within your supply chain. You need to work out which rules apply to you; most data protection regulation is extra-territorial, meaning that it applies to data belonging to residents of a country irrespective of where that data is processed or by whom. You have to show that you put data subjects' interests first and that you've taken the right steps to protect them.
At the same time you need to get on with doing business. Transfers of data between countries remain essential to efficient business operations, so you need a practical approach that doesn't stop you working.Act now and talk to us today
Effective legitimisation of international transfers includes technical measures like encryption or pseudonymisation; effective information security policies and procedures; practical steps such as minimisation or localisation of selected data; and of course effective oversight and control of your supply chain.
There is an ever-increasing volume of paperwork, from data processing agreements with specified clauses through transfer risk assessments and data protection impact assessments to selection and documentation of appropriate lawful bases for the transfer.
You need not only to understand, quantify and treat transfer risk, but also be ready to demonstrate your compliance to regulators. Do you have the resources to do all of this and still keep on top of your other business and data protection duties?
As well as satisfying regulators, you also need to keep data subjects informed. In some cases you may need to obtain their consent. The information you provide must be compatible with their local law as well as your governing regulations, and must be presented in a form they can understand.
A long written privacy notice in legal English is no longer adequate. You should consider layered notices, use of video and infographics and contextual privacy information. All of this also takes time and needs specialist support.
Your business units need to understand their obligations - and your proposed risk treatments need to meet their business needs. Your risk function and your board must be kept up-to-date - and regulators will want to see that you have effective governance, including audit and routine review.
We map all your data flows, identifying where data is transferred, which partners are involved, what business process is being served and what the risks really are.
We review the mapped flows to ensure that the appropriate paperwork and supporting reasoning is in place across all of the data protection regimes that apply.
We check that you have the right safeguards in place and that they are being applied correctly. This includes comprehensive audit of your supply chain for security and compliance.
Sometimes doing less is the best answer. We will help you find ways to reduce what is being transferred, or to transform identifiable data into aggregated or anonymised information without reducing business effectiveness.
Whether you are responding to a regulator, a supply-chain partner, a customer or a data subject we will be there to support you, ensuring that each party receives the right information at the right time in the right format.
Proper compliance requires continuous vigilance, both to ensure that the defined policies and procedures are being followed and to check that supply chain partners are meeting their obligations. Let us take the strain.
Working in conjunction with your privacy office, we undertake a detailed review of your existing practices to identify and map your existing data transfers. For each transfer we review the lawful basis, the required compliance paperwork and the supply chain; we also work with you to map the flow against your business processes to understand the underlying requirement and the operational goal.
We deliver a comprehensive report quantifying transfer risks and giving detailed remediation recommendations.
Working from our audit report we implement the recommended recommendations in direct partnership with the relevant business unit and your privacy and infosec teams. The work ranges from contract review and the implementation of appropriate data protection clauses through to technical risk mitigation and process change.
Remediation is delivered on a risk-prioritised basis that combines rapid treatment with ongoing knowledge transfer.
Compliance is a continuous process. We embed within your organisation to provide an ongoing support service, helping identify and legitimise new transfers and address changes to existing processes. We establish and operate a routine review process to monitor both internal and supply chain compliance.
We work with your privacy and infosec functions to deliver integrated business support and timely governance reporting.
Throughout our work we are always looking for ways that data protection can be leveraged to improve business processes and simplify your compliance regime.
This can include reducing what is being transferred, aggregating data so that it is no longer identifiable, using privacy enhancing technologies or changing the location of selected processing. In all cases we work hand in hand with business units to ensure that the outcome benefits both the data subject and the bottom line.
We work globally as a specialised privacy consultancy in more than 50 markets. Our clients include some of the largest global firms in their sectors.
Data privacy is an increasingly important aspect of governance as both populations and governments focus their attention on a corporation’s responsibilities in a social context.
We have practical on-the-ground experience in most of the world’s privacy regimes and know where to look for the conflicts between them.
We bring global experience of data privacy and information security assessment and remediation from multiple sectors and perspectives, as well as a formidable array of certifications across a culturally diverse team.
Our approach is strategic, risk-driven, forward looking, positive and practical – our recommendations are not theoretical or academic interpretations, they are implementable plans.
Continuously evolving tools including privacy benchmarking, comprehensive audit and discovery tools with risk-scoring and flow through to dashboard and recommendations.
We are not a law firm, but we employ lawyers. We’re not a cybersecurity business but our staff qualifications include CISSP and CISA. We’re not selling a one-size-fits-all tech product, but we’ve built proprietary tools and techniques that work with the class-leading GRC products to simplify and streamline the hardest tasks in assuring privacy.
We’re corporate members of the IAPP, and all our consultants are required to obtain one or more IAPP certifications. We’re ISO 27701 and 27001-certified and have a comprehensive set of policies and frameworks to help our clients achieve and maintain certification. Above all, our relentless focus is on practical operational delivery of effective data privacy for all your stakeholders.
Start a conversation about how our international data transfer service can benefit your business. You can also find out more about how to become involved in our research.