Data Transfers — ResGuard

Key Concept 5 — Data Transfers

Data that leave your organisation need a reason — and data that leave the country need protection.

Personal data rarely stay inside one system: they go to service providers, group companies, partners and authorities, and very often to servers abroad. Each of these flows has its own rules.

Three kinds of transfers

To a processor that works on your behalf, e.g. payroll provider, cloud or IT support: a written contract with instructions, confidentiality and security is required.
To another controller that uses the data for its own purposes, e.g. insurer, bank, group company or authority: needs its own legal basis, and the data subjects must be informed.
Across borders: the destination country must offer adequate protection, or safeguards such as contractual clauses or group rules must be in place, unless an exception applies.

Easy to overlook: remote access from abroad (e.g. support teams or a parent company) and cloud services hosted outside the country count as transfers, too.

Transfers in your jurisdiction

Chile

International transfers under Law 21.719 are allowed to countries the Agency considers adequate, or with safeguards such as contractual clauses, binding corporate rules or other models approved by the Agency, or under the exceptions of the law (e.g. consent or the performance of a contract). Processing by a processor (encargado or mandatario) requires a written contract.