Data protection and security

Companies in Switzerland, Germany and Austria ask about data protection first, and rightly so. Here is how we approach it, and what you should ask any provider.

What changes when work moves to Kosovo

Kosovo is outside the EU. Personal data sent from the EU or Switzerland to a country outside them usually needs appropriate safeguards, for example standard contractual clauses. Your data protection officer or lawyer decides what applies to you. We help you prepare and put it in place.

What we help you set up

• A data processing agreement with the team or partner that handles your data
• Standard contractual clauses and a transfer assessment, where they are needed
• Confidentiality agreements for everyone with access
• Access only to what each person needs, preferably inside your own systems
• Written procedures, staff training and a clear way to report incidents
• Rules for deleting data when the work ends

Questions to ask any provider

• Where is data stored, and who can access it?
• Does the provider use subcontractors, and which ones?
• Which security standards or certifications does it hold, and can you see the proof?
• Can you audit the provider, or review its audit reports?
• What happens in a data breach, and how fast do you hear about it?
• What happens to your data when the contract ends?

Our role

We do not replace your data protection officer or your lawyer. We connect you with licensed local professionals, bring your questions to our partners, and make sure the answers are written into the contract.

Sources: PwC Switzerland on transfers under the Swiss data protection law, CEE Legal Matters on Kosovo data transfers.

General information only, not legal advice. Data protection rules change and depend on your situation, so confirm with a qualified lawyer.