Outsourcing For Small And Medium Businesses: New Guidance On Data Transfers

What is the relevance of the data protection regime to an outsourcing transaction? In an outsourcing transaction, data processing (i.e. the transfer of the data) may take place at several stages: during due diligence; perhaps during contract negotiation; and during the transition or implementation stage.

The data controller (i.e. the customer) must satisfy itself that it can legitimately transfer the data to the outsource vendor and that any such transfer will comply with the first data protection principle, that is, fair and lawful processing. This requirement is generally satisfied either by the fair processing conditions of "consent" (not always practical due to considerations of commercial sensitivity or confidentiality) or "legitimate interest" (more frequently used). However, where sensitive personal data are concerned, the Act imposes an additional condition. While the condition most frequently relied upon in this context is consent, it must be