This contentious and fast-moving area of data protection law throws up challenges for nearly every business. But it’s especially acute for online businesses working in multiple territories. Working out who’s the exporter and the importer, what roles they play in doing so, what measures are required to protect the data and even where all the data is actually going to in the first place, can present a formidable challenge.

We can help you navigate this messy area. We’ll help you fill out the “standard contractual clauses” and the ICO’s addendum to them, advise you on compliance with them, draft intra-group data sharing agreements and coordinate with local counsel on transfer impact assessments. 

Our approach is practical and risk-based, looking at the nature of the data, the extent of the transfers and the resulting risks to the people concerned. We’ll help you to document these assessments and draft the relevant paperwork in a way that gives you a good chance of standing up to scrutiny, without breaking your business.