Data Transfers — ResGuard

Key Concept 5 — Data Transfers

Data that leave your organisation need a reason — and data that leave the country need protection.

Personal data rarely stay inside one system: they go to service providers, group companies, partners and authorities, and very often to servers abroad. Each of these flows has its own rules.

Three kinds of transfers

To a processor that works on your behalf, e.g. payroll provider, cloud or IT support: a written contract with instructions, confidentiality and security is required.
To another controller that uses the data for its own purposes, e.g. insurer, bank, group company or authority: needs its own legal basis, and the data subjects must be informed.
Across borders: the destination country must offer adequate protection, or safeguards such as contractual clauses or group rules must be in place, unless an exception applies.

Easy to overlook: remote access from abroad (e.g. support teams or a parent company) and cloud services hosted outside the country count as transfers, too.

Transfers in your jurisdiction

Switzerland

Disclosure abroad is allowed to countries the Federal Council lists as adequate (including the EU/EEA and the UK, and US companies certified under the Swiss-US Data Privacy Framework). Otherwise, safeguards are needed, e.g. standard contractual clauses recognised by the FDPIC (the EU SCCs with Swiss adaptations) or binding corporate rules, or an exception such as consent. Processors need a contract, and sub-processors require the controller's prior approval.