Show contents
Why corporate groups need dedicated data protection structures
Corporate groups often process personal data across several legal entities, locations and countries. Shared IT systems, central services, group-wide HR processes and integrated customer offerings create operational connections. From a data protection perspective, however, each processing activity still requires a clear assessment of which entity determines its purposes and means and therefore acts as controller.
Membership of the same corporate group does not in itself permit personal data to be shared freely. Every disclosure requires an appropriate legal basis. Depending on the actual allocation of tasks, group entities may act as separate controllers, joint controllers, or as controller and processor. The decisive factor is who determines the purposes and essential means in practice, rather than the label used in a contract.
Define responsibilities and roles clearly
Group-wide data protection management requires clear governance. This includes responsibilities at entity level, shared professional standards and reliable contacts in each location or business unit.
Under Article 37(2) GDPR, a group of undertakings may appoint a single data protection officer provided that the officer is easily accessible from each establishment. Responsibility for lawful processing nevertheless remains with the relevant controller entities. Data protection coordinators can support the DPO, consolidate information from individual units and accompany the implementation of agreed measures.
Create central transparency over processing and data flows
A shared view of actual processing is the starting point:
- Which entity processes which personal data?
- For which purposes and on which legal basis?
- Which systems, locations and recipients are involved?
- Which processors and other service providers are used?
- Are data transferred to countries outside the European Economic Area?
- Which retention and erasure requirements apply?
A coordinated record of processing activities helps document this information consistently. Shared templates and terminology make collaboration easier, while the content must still reflect the real processes of each controller entity.
Joint controllers, separate controllers or processing on behalf of another entity?
Where several entities jointly determine the purposes and essential means of processing, they may be joint controllers under Article 26 GDPR. The parties must then transparently allocate responsibility for fulfilling their obligations. Where one entity processes personal data solely on the documented instructions of another, a processor relationship under Article 28 GDPR may apply. Entities acting for their own purposes may be separate controllers.
The assessment should be performed for each processing activity. One role model for the entire group will rarely reflect the variety of business processes. The European Data Protection Board’s Guidelines 07/2020 provide further criteria for distinguishing controllers, joint controllers and processors.
Control international data transfers
Intra-group transfers to third countries are subject to Articles 44 to 49 GDPR. Depending on the destination and circumstances, relevant transfer tools may include adequacy decisions, Standard Contractual Clauses or Binding Corporate Rules. Organisations must also assess whether the selected safeguards are effective in the specific transfer context and whether supplementary measures are needed.
Implementation in four steps
1. Map the organisation and scope
Record legal entities, locations, business units, systems and central services. Define roles, contacts and escalation paths based on this organisational map.
2. Document processing and data flows
Bring together existing records, agreements and policies. Assign internal and external recipients, processors, third-country transfers and legal bases to the relevant processing activities.
3. Prioritise risks and required action
Assess gaps according to their legal and operational relevance. Examples include missing agreements, unclear responsibilities, undocumented transfers, unresolved data subject requests or processing that is likely to result in a high risk.
4. Organise operations and evidence
Assign measures to responsible owners, deadlines and transparent status information. Turn recurring reviews, erasure requirements, data protection impact assessments, incidents and data subject rights into defined workflows.
How Robin Data can support corporate groups
ComplianceOS can connect entities, roles, processing activities, agreements, measures and evidence in a shared working environment. Permissions and responsibilities help combine central standards with decentralised accountability. Robin Data Services can support the initial assessment, professional classification and ongoing development of the processes. Legal advice on a specific case must be obtained from an appropriately authorised adviser.
Book a discovery call to discuss your starting point and a suitable approach to group-wide data protection management.