In an era of globalization, transferring data abroad as part of the outsourcing of data processing activities is gaining in importance, particularly for multinational groups. Moreover, as a consequence of the division of tasks, data processing is regularly entrusted to a subcontractor. This raises important issues, such as the data protection requirements that must be fulfilled before data can be transferred to a contractor or subcontractor abroad.
According to the Data Protection Act, the processing of personal data may be contracted out to a third party, i.e. a contractor. However, the law stipulates that the data may only be processed in the way that the contracting entity is authorized to process them. It flows from this that a contractor who wishes to use the services of a subcontractor for the data processing must have a contract with the subcontractor which instructs the latter to process the data in accordance with the law applicable to both the contracting entity and the contractor. These legal provisions apply, irrespective of whether the data processing is carried out by a contractor or a subcontractor in Switzerland or abroad. If the contractor or subcontractor is based outside Switzerland, the provisions of Article 6 of the FADP also apply.
We have published a set of documents dealing with the problem of outsourcing data processing activities abroad on our website. The reader will find a description of the most common cases of outsourcing and the data requirements that must be respected (cf. www.derbeauftragte.ch, Topics - Transfers abroad - Outsourcing).
Furthermore, we have updated the model contract for the outsourcing of data processing abroad (Swiss Transborder Data Flow Agreement), and we have added additional provisions concerning data processing by subcontractors. According to those provisions, the transfer of data processing activities is only authorized with the prior written consent of the contracting entity. In addition, the contractor is required to conclude a written contract with the subcontractor wherein the latter undertakes to abide by the same data protection standards as his direct client, i.e. the contractor. The contract can be found in English on our website (www.derbeauftragte.ch, Topics, Transfers abroad - Outsourcing).