In an increasingly international market, with businesses operating in multiple countries, most will collect, store and share data across jurisdictions. This can present several challenges due to varying legal, regulatory and cultural factors, which can cause a headache with compliance, particularly for SMEs with limited budgets and resources.

With the move to accountability, where it is not enough to just comply but businesses now need to demonstrate how they comply, and the potential for substantial fines if rules are breached, the importance of getting it right cannot be understated.

5 Key Challenges

Data protection & privacy regulations

One of the clearest challenges businesses face when operating internationally is that different jurisdictions will have their own data privacy and protection laws, which can impact how data can legally be collected, processed, stored and transferred. Failure to comply does not only mean a risk of severe penalties and fines, but increasingly an impact on the reputation of a business which can be hard to undo. Within the UK and Europe, there are comprehensive rules on data protection but within the US, privacy laws are more fragmented and vary from state to state. Organisations need to understand the applicable laws to be able to comply with the requirements but cannot just focus on key data protection legislation – there may be other ancillary laws that also impact data use and privacy (like electronic marketing and computer misuse within the UK). This all means it can become complex to navigate from one jurisdiction to another and can result in potentially conflicting legal requirements in different countries.

Cross border transfers

In addition to the general privacy regulations, businesses will likely experience the challenges in dealing with the restrictions that normally apply to cross-border transfers of data. The practicality of sending personal data from one country to the next can become burdensome when organisations need to look at how data can lawfully be transferred to another country (whether that is relying on an adequacy finding, getting express consent from individuals, using approved contract terms or relying on exemptions). This can be especially complex when jurisdictions have different data protection requirements in place. Additionally, some countries are now introducing data localisation which means certain types of data needs to be physically stored within the country’s border which would then mean cross-border transfers are not permitted at all.

Technical infrastructure

Data processing rules will normally require appropriate technical and organizational measures are put in place for transfers but it can be difficult to ensure this in place when countries have varying levels of infrastructure and resources available. Data security will always be a challenge but specific threats and risks will vary depending on the location. This can directly impact the efficiency and effectiveness of data processing operations and creates difficulties for businesses looking to engage processors in other countries and require the same standards of technical infrastructure as in the controller’s home country.

Language and cultural differences

Operating in multiple jurisdictions will obviously involve different languages and cultural approaches. While not unique to the processing of personal data, these differences can create a significant impact, particularly when it comes to understanding and interpreting data and protecting that data. For example, certain terms or concepts may have different meanings in different languages or cultures, which can lead to misunderstandings and errors in data processing or there may be a different attitude to data privacy which can impact how companies are able to process personal data.

Political/legal/enforcement changes

Data protection compliance is not static and will be an ongoing journey for organisations, who will need to amend and update as business practices change. It is also important to keep an eye on government policies and general enforcement approaches which may be updated or changed and can impact the legal landscape for data processing. Particular attention should be paid to jurisdictions where there is political instability or uncertain legal frameworks which can make it difficult to process data reliably and securely.

What does it mean for you

Given the challenges outlined above, data processing in different jurisdictions can be complex. The move to accountability means businesses cannot simply plead ignorance for failing to follow applicable law when processing personal data. Add in the potential for substantial fines (in multiple jurisdictions if a business has not complied in several countries), compensation due to individuals affected and ongoing reputational damage means organisations need to carefully understand and navigate these challenges to effectively mitigate risks involved in operating in different jurisdictions.

How can we help?

The Data Protection team at MBM Commercial can give legal as well as commercial advice on data processing matters. We have a team experienced in dealing with cross border transfers, and can help with appropriate contract provisions and wider policies and procedures to enable the smooth transfer of data between countries. Seeking legal advice is crucial to help with compliance and mitigate risks associated with cross-border transfers of data, so get in touch with us today and we can get you set on the right path going forward.