Schrems II

The Schrems II ruling underscores the need to ensure personal and sensitive data is protected under GDPR, when it is transferred to/from EU and other non-EU countries. As a result of the ruling European Data Protection Board (EDPB) recommends a six-step plan for continually assessing and protecting global data flows in-line with EU data privacy regulations.

Step 1: Know your data transfers

The first step is to ensure that you have a record of all data transfers with other countries outside the EU logging the series of processors and sub-processors. You must verify that the data you transfer is adequate, relevant and limited to what is necessary to be processed in the third country.

Step 2: Identify the transfer tools you are relying on

The second step is to identify the data transfer tools you are relying on among those listed in Chapter V of GDPR, and take decisions relating to some or all of the third countries to which you are transferring data, that they offer adequate level of protection of personal data.

Step 3: Assess whether the transfer tool is sufficient to meet GDPR (article 46) requirements

The transfer tool must ensure that the level of protection guaranteed by GDPR within the EU countries is as good in the third country outside the EU. Your assessment should take into consideration all the actors participating in the data transfer (e.g. controllers, processors and sub-processors) processing the data in third-countries.

Step 4: Adopt supplementary measures

If the assessment in step 3 has revealed that the transfer tool is not effective, then you will need to consider supplementary measures which, when added to the safeguards could ensure the same level of safeguards guaranteed within the EU are enforced for external data transfers.

Step 5: Procedural steps if you have identified supplementary measures

You may have to take these supplementary measures, if the primary measures used by the data transfer tools are not sufficient to protect the data.

Step 6: Re-evaluate at appropriate intervals

You must monitor on an ongoing basis, and where appropriate in collaboration with data importers in the third countries to which you have transferred data, put in sufficient mechanisms to promptly suspend data transfers, if the data importer breached the contract.

Thales enables organizations to maintain compliance with GDPR and adhere to the European Data Protection Board (EDPB) recommendations for adopting Schrems II ruling using the six-step plan for continually assessing and protecting global data flows.

The CipherTrust Data Security Platform unifies data discovery, classification, data protection, and unprecedented granular access controls with centralized key management under your control – all on a single platform. It enables organizations to deploy bring your own encryption (BYOE) and tokenization policies to protect sensitive data at rest in both EU (data exporter) and non-EU countries (data processors).

• Discover: Before data is transferred out of EU, data exporters must be able to discover sensitive data records wherever they reside and classify them based on GDPR compliance requirements. CipherTrust Data Discovery and Classification enables organizations to get complete visibility into sensitive data on-premises and in the cloud, and then apply appropriate data protection measures as outlined by GDPR.
• Protect: Once the data exporter knows where sensitive data resides, they can protect that data with encryption and tokenization solutions provided by CipherTrust Transparent Encryption and CipherTrust Tokenization before it moves to downstream data importers in other non-EU countries, and provide the same level of data protection in those countries too.
• Control: Every data security regulation including GDPR requires organizations to control access to data, centralize key management services, and monitor authorized and unauthorized access to data and encryption keys. CipherTrust Manager and CipherTrust Cloud Key Manager enable data exporters and importers of EU to maintain control over keys and security policies across on-premises and multi-cloud environments.