Eu Perspective On Offshoring & Data Protection

When considering outsourcing services relating to EU operations to a nonEU country, the customer must also consider several factors that involve data protection. Those factors include:

• Will the performance of the outsourced services require the transfer and “processing” of “personal data,” taking into account the broad definition of “processing” under EU legislation?

• If so, has the destination nonEU country been formally recognized by the European Commission as providing adequate protection for data subjects in relation to the processing of personal data?

• If the destination country has been formally recognized, the customer should ensure that the outsourcing contract contains sufficient obligations and restrictions relating to the processing of personal data by the supplier to enable the customer to continue to comply with its obligations as a data controller under national law;

• If the destination country has not been formally recognized, the customer and the supplier company performing the services in the nonEU country should sign the EUapproved standard clauses to ensure that the processing in question complies with EU and local data protection legislation. This will be in addition to the data processing obligations and restrictions in the main outsourcing contract.