Why compliance with privacy legislation is outsourcing 101
Most businesses rely on earned trust to earn their crusts. Which makes respecting customers’ privacy central to business success.
Recommendations and referrals drive over 80% of B2B sales. Customer reviews fuel online B2B and B2C sales. And good favour doesn’t come any business’s way if there’s any hint that it might misuse customers’ data and / or fail to keep it safe.
Yes, brand building marketing is critical to grow wider appeal. And email, PPC, SEO, AI search all support demand generation. But decisions in your favour happen far more often when leads read favourable testimonials…or have their view confirmed by a recommendation from someone whose opinion they trust.
Yempo Solutions is no different. Recommendations and referrals drive much of our business. Testimonials turn interest into intent. Which makes helping our clients to comply with privacy legislation a key pillar of our business model.
What is GDPR?
The General Data Protection Act is, post Brexit, two acts.
- UK GDPR: introduced Jan 1, 2021, is a retained version of the EU Data Protection Act 2018, with small amendments for the UK.
- EU GDPR: Applies to all EU member states and EEA countries.
Both versions of GDPR apply to organisations outside of UK and EU jurisdictions where these organisations handle UK and EU individuals’ data outside of the EU. Which is why GDPR compliance and outsourcing to the Philippines are intrinsically linked.
Read More: A comprehensive guild to UK vs EU GDPR legislation
The 7 GDPR principles that impact offshore IT, offshore accounting, and offshore business support teams
GDPR contains seven key principles that firms handing personal data must comply with. Personal data must be:
1. Processed lawfully, fairly and in a transparent manner in relation to individuals.
2. Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes.
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
4. Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
5. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals.
6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
In addition, article 5(2) adds that:
7. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1.
Learn more about UK GDPR: UK Information Commissioners Office GDPR Guides.
We’ve highlighted principle 6, data processing, as ‘ensuring appropriate security of personal data’ impacts outsourcing. But it depends on what we mean by outsourcing.
How GDPR impacts different outsourcing models.
This is true outsourcing. The outsourcer can decide how to manage and complete the task – including personal data handling and compliance. And here comes the BIG BUT. The client business cannot also hand over responsibility for GDPR compliance, even if the outsourcing happens outside the EU or UK.
In this scenario, contracts must cover how GPPR compliance is maintained. Auditing needs to be in place to ensure that GDPR compliance commitments are met.
The consequences if this goes wrong are considerable. In the UK, these can amount to £17.5 million or 4% of the total annual worldwide turnover in the preceding financial year, whichever is higher.
In this scenario, offshore talent is technically employed by Yempo Solutions (as a registered Employer of Record in the Philippines). Practically, talent only works for your business as pseudo ‘remote employees’.
They:
- Use your business processes;
- Use your systems;
- No data transfer takes place;
- Responsibility for GDPR training and compliance remains with you.
The only client-side personal data Yempo Solutions holds is your company phone number, company address, and email addresses, and our contract with you. This makes is possible to build (for example) a GDPR-compliant IT helpdesk in the Philippines, or an offshore accounting pool that answers your clients’ Making Tax Digital queries.
An easy way to think of it is to operate the same processes you use when engaging a UK-based remote employee in Birmingham when your office is in Brighton.
In this scenario, you GDPR train your offshore team in the Philippines as you would your UK-based team.
This scenario can work well for large employers that can afford the necessary internal legal and HR expertise. But direct employment adds significant legal risk for UK SMEs.
Unlike some countries, the Philippines has comprehensive employment legislation. Compliance with this legislation requires expertise that most SMEs lack.
Yempo Solutions is a registered Employer of Record in the Philippines and so ensures compliance with employment regulations, protecting SMEs from risk.
Learn more:
Complying with Common Philippines Labour Laws: A Guide for Outsourcing
Outsourcing to the Philippines without the legal risks.
‘Peace of mind. An employer who fully understands local labour laws.’ – David D., Yempo Solutions client
GDPR training for offshore teams
Compliance is integral to Yempo Solutions’ operating model, just as it is for yours. As a company, we comply with the requirements of the Australian Privacy Act. Many requirements follow GDPR rules. But there are important differences.
Read: GDPR vs Australian Privacy Act
GDPR training for offshore teams remains your responsibility. In our experience, clients prefer this model as there’s no ambiguity. They know exactly what training has, and has not, been received. They complete GDPR compliance audits on their offshore talent in the Philippines as they would local teams.
How UK SMEs can build a GDPR compliant team in the Philippines.
With over a decade’s experience enabling small and medium-sized enterprises to build offshore teams in the Philippines, our team of experts will provide end to end support for you (particularly valuable if you’re new to outsourcing).
We will lead you through our proven three-step process:
1. Identify the skills you need that will free up your higher cost staff.
Let us know your requirements, be they IT Technical Analysts, Developers, or Testers. Maybe you need a bookkeeper or accountant? We source the best staff to meet your needs, personally screen them and submit a shortlist for your review.
You interview a shortlist via a video call to determine their suitability for your needs. Give us the go-ahead and we make an offer to the individual(s) you select, and complete police and other security checks.
2. Allocate a staff member in your home team to train the new hire.
Just as you would in your own office, you onboard your new hire via video conference, using our robust infrastructure.
3. We do the rest! We take care of your staff, payroll, and employee compliance.
We ensure your staff members feel a part of the Yempo Solutions team in an excellent working environment while being dedicated and fully committed to only your business.
We also provide you with cultural primers that will help you get the best out of your new employees. Building a whole team? We step back a little and support you in promoting your own culture into your offshore team.
You only need to ensure that your new IT, Accountancy and / or Business Support staff are kept busy.
Any performance concerns or issues, just contact us and we will take care of the rest.
Get started – build your GDPR compliant team in the Philippines.
Why companies prefer outsourcing to the Philippines with Yempo Solutions:
- Specialist provider of quality, lower cost, IT, Accounting and Business Support resources.
- Access to high quality, well educated, accountancy & IT staff.
- Cost effective versus local hires (save 70%.)
- End to end support, from IT, legal, and HR compliance.
- High quality technology.
- Happy staff that are treated as you would your in-country teams.
- Ability to rapidly flex teams and facilitate growth.
- Ready access to happy clients for reference-checking the entire experience.
Get started – build your GDPR compliant team in the Philippines: https://www.yempo-solutions.com/outsourcing-solutions-philippines/
