Data Transfers — ResGuard

Key Concept 5 — Data Transfers

Data that leave your organisation need a reason — and data that leave the country need protection.

Personal data rarely stay inside one system: they go to service providers, group companies, partners and authorities, and very often to servers abroad. Each of these flows has its own rules.

Three kinds of transfers

To a processor that works on your behalf, e.g. payroll provider, cloud or IT support: a written contract with instructions, confidentiality and security is required.
To another controller that uses the data for its own purposes, e.g. insurer, bank, group company or authority: needs its own legal basis, and the data subjects must be informed.
Across borders: the destination country must offer adequate protection, or safeguards such as contractual clauses or group rules must be in place, unless an exception applies.

Easy to overlook: remote access from abroad (e.g. support teams or a parent company) and cloud services hosted outside the country count as transfers, too.

Transfers in your jurisdiction

Peru

Cross-border flows (flujo transfronterizo) are only allowed to countries with an adequate level of protection, or if the exporter ensures that the recipient protects the data as required by Law 29733, e.g. through contractual clauses. Exceptions include consent and the performance of a contract. Document the flows, as the Regulation requires them to be reported to the ANPDP.