Source: Deutsche Nachrichten
Data sovereignty and jurisdiction have become important criteria when procuring digital services. This is particularly relevant for background checks because they may involve identity data, employment history, education and – only where legally permitted – criminal-record information. The GDPR does not require all personal data to remain physically within the EU: international transfers can be lawful when the mechanisms provided by the Regulation are met.
For Validato, a European Human Risk Management provider, an architecture centred on Switzerland and the EU reduces transfer complexity and supports clear governance. Switzerland benefits from an EU adequacy decision, allowing personal data to be transferred from the EU to Switzerland without additional transfer safeguards. “Global Screening does not require Global Data Storage. For us, keeping core data within a European and Swiss data-protection framework is an architectural and trust decision – not a claim that other models are automatically unlawful,” says André Naef, CEO of Validato.
Validato recommends that Spanish CISOs assess processing locations, relevant jurisdictions, subprocessors, international-transfer mechanisms, retention periods and security measures when selecting a screening provider, alongside compliance with the GDPR and applicable Spanish law.
About Validato: Validato is an international provider of background checks and Human Risk Management, headquartered in Zurich, Switzerland, and operating internationally. Its modular, ISO 27001-certified platform enables companies to configure candidate and employee checks according to the role and within the applicable legal framework. Core data is processed and stored in Switzerland and the EU and, under Validato policy, deleted within a maximum of 120 days. No minimum volumes and no setup fees.
Media contact: André Naef, CEO Validato S.A., · Claridenstrasse 34, 8002 Zurich, Switzerland · +41 44 515 77 78 · validato.com