Data Transfers — ResGuard

Key Concept 5 — Data Transfers

Data that leave your organisation need a reason — and data that leave the country need protection.

Personal data rarely stay inside one system: they go to service providers, group companies, partners and authorities, and very often to servers abroad. Each of these flows has its own rules.

Three kinds of transfers

To a processor that works on your behalf, e.g. payroll provider, cloud or IT support: a written contract with instructions, confidentiality and security is required.
To another controller that uses the data for its own purposes, e.g. insurer, bank, group company or authority: needs its own legal basis, and the data subjects must be informed.
Across borders: the destination country must offer adequate protection, or safeguards such as contractual clauses or group rules must be in place, unless an exception applies.

Easy to overlook: remote access from abroad (e.g. support teams or a parent company) and cloud services hosted outside the country count as transfers, too.

Transfers in your jurisdiction

Spain

Within the EU/EEA, data flow freely. Transfers to other countries need an adequacy decision of the European Commission (e.g. UK, Switzerland, Japan, or US companies certified under the EU-US Data Privacy Framework), appropriate safeguards such as standard contractual clauses (SCCs) or binding corporate rules (Art. 46 GDPR), or, for occasional transfers only, an exception such as explicit consent (Art. 49 GDPR). With SCCs, a transfer impact assessment is expected. Processors need a contract under Art. 28 GDPR.