Transferring personal data

In the public sector of the Canton of Vaud, the outsourcing of data processing is possible when three conditions are met:

• a legal basis or a contract exists for subcontracting,
• the institution is entitled to process the data itself,
• there is no obligation to maintain secrecy, in particular official secrecy.

In general, the conclusion of a contract is not necessary. In most cases, there is no legal basis for subcontracting.

The contract ensures that the subcontractor complies with data protection rules and guarantees an adequate level of protection when there is cross-border communication.

The data controller who uses a data processor remains wholly responsible for compliance with data protection law vis-à-vis the data subject.

When it is necessary to communicate personal data abroad, there are two possible scenarios:

• The communication takes place to a country that is on the list of eligible countries  établished by the Conseil Fédéral,
• The recipient country is not recognised as appropriate by the Confédération.

When the recipient country is appropriate, personal data can in principle be transferred, if the conditions for outsourcing are met (see above).

Where the country is not suitable, the transfer of data is only authorised under certain conditions (Article 17 LPrD).

The University of Lausanne has adopted a Cloud doctrine for processing all requests for transfers abroad.The policy requires a methodical analysis of the compliance of the conditions of the transfer abroad and of the subcontracting. Before any new transfer of personal data abroad, please contact the DPO.