Data protection is a legal requirement in every country you operate in.
Not a policy choice, and not only a European one. HSP’s data privacy consulting establishes what each jurisdiction requires of you as a data controller, drafts the documentation that proves it, and handles the registrations that go with it.
Tell us where you hold or process personal data. A consultant replies within one business day.
Where we advise
The exposure is rarely where companies look for it.
Most groups have a privacy policy on their website and assume that is the obligation discharged. Three things tend to be missing, and all three are enforceable.
The risk assessment itself is mandatory
A risk assessment of your global operations, confirming that appropriate legal documentation and processes exist for each country’s data protection legislation, is a strict compliance requirement rather than good practice. Non-compliance carries fines that reach into the millions.
Moving data between countries needs a mechanism
Sending personal data out of the EU or the UK requires a legal transfer mechanism in place before the transfer happens. We draft the EU Standard Contractual Clauses and UK International Data Transfer Agreements that provide it, and review existing contracts for the same.
Some countries require you to register
A number of jurisdictions require mandatory registration of every data controller processing personal information, and the appointment of a named data privacy point of contact. We handle the registrations and filings, and can act as the local point of contact with the authority.
What you are required to hold, and what you should.
A gap analysis tells you which of these exist, which are out of date and which were never drafted. The engagement then produces the missing ones and implements the recommendations.
- Fair process notices, the template that sets out what each jurisdiction requires you to tell individuals
- Contract reviews against the data privacy and GDPR obligations your agreements already carry
- Implementation of the recommendations, not just the list of them
- Internal data privacy policy
- External web-based privacy policy
- Data and records retention policy
- EU Standard Contractual Clauses
- UK International Data Transfer Agreement
- Fair process notices
- Cookies policy
- Contract reviews for GDPR compliance
- Country-specific controller registrations
- Named data privacy point of contact
- Records of processing activities
- Gap analysis remediation plan
Assess, draft, register.
A risk assessment of your global operations against the data protection legislation of each country you operate in, producing a gap analysis of the documentation and processes you hold today versus what is required.
Preparation of the mandatory and supplementary documentation, including internal and external privacy policies, retention and cookies policies, SCCs and IDTAs, and fair process notices for each jurisdiction.
Country-specific controller registrations and filings with the relevant government agencies, appointment of a data privacy point of contact, and HSP acting as that local contact where required.
What we cover.
GDPR and data privacy risk assessments
Mandatory risk assessment of your global operations to confirm appropriate legal documentation and processes are in place for the data protection legislation of each country. Non-compliance can result in significant fines and penalties.
Data privacy documentation
Drafting mandatory and supplementary documentation and implementing the recommendations from the gap analysis, including internal and external privacy policies, retention and cookies policies.
Cross-border transfer mechanisms
EU Standard Contractual Clauses and UK International Data Transfer Agreements, drafted and put in place, plus contract reviews against the data privacy and GDPR obligations your existing agreements carry.
Fair process notices
Preparation of the template notice that sets out the information you are required to provide to individuals under the data protection legislation of a given jurisdiction.
Country-specific registrations
Some countries require mandatory registration for all data controllers processing information, and the appointment of a data privacy point of contact. We support the registrations and filings with government agencies.
Local point of contact
Where a jurisdiction requires a named local contact for communications with the data protection authority, HSP can act in that capacity on your behalf.
More on data across borders.
Questions we get asked.
We are not in Europe. Does this apply to us?
Data protection legislation exists in every country, not only in the EU, and the obligation attaches to where the data subjects are rather than where you are incorporated. If you employ people or hold customer data in a jurisdiction, that jurisdiction’s law applies to you.
We already have a privacy policy on our website. Is that enough?
It is one of several required documents, and usually the only one a company has. An external web-based policy does not cover the internal policy, the retention policy, the fair process notices owed to employees, or the transfer mechanism needed to move data out of the EU or the UK.
What is the difference between SCCs and the UK IDTA?
They do the same job for different regimes: EU Standard Contractual Clauses provide a lawful basis for transferring personal data out of the EU, and the UK International Data Transfer Agreement does so for the UK. A group operating in both usually needs both, and they are not interchangeable.
Do you act as our Data Protection Officer?
Where a jurisdiction requires a named data privacy point of contact for communications with the authority, HSP can act in that capacity. Whether a formal DPO appointment is required depends on your processing activities, and the risk assessment establishes that.
Are you providing legal advice?
No. This is compliance consulting grounded in local data protection practice, and we work alongside your legal counsel where a matter requires legal advice. This page is general information and is not legal advice.
We are mid-acquisition. Does privacy come into it?
Yes, and it is frequently missed. Employee and customer data moving between buyer and seller needs a lawful basis, and the target’s documentation gaps become yours at completion. Data privacy is one of the core workstreams in our M&A consulting for exactly that reason.
Start with the risk assessment.
Tell us where you hold or process personal data, and we will tell you what each of those jurisdictions requires of you.
A consultant replies within one business day. No sales sequence.