GDPR compliance - not an “adequacy decision” country
<p>Our corporate website's server is located in a country that's considered not an “adequacy decision” country, according to GDPR.
I'm aware that GDPR allows that (under certain conditions). It's just I don't understand exactly what must be done to match those requirement. GDPR says: &quot;In the absence of an adequacy decision, the GDPR does allow a transfer if the controller or processor has provided “appropriate safeguards”. These safeguards may include:</p>
<p>Standard data protection clauses: Then some legal mumbo-jumbo that means nothing to me.
Binding corporate rules “BCRs”: Then some legal mumbo-jumbo that means nothing to me.</p>
<p>So as a Data Protection Officer - what exactly should I do (if anything)?
And if the company is registered in the UK, then if I were to seek legal advice, I must turn to UK lawyer or any lawyer in EU could do that?</p>

<blockquote>
<p>So as a Data Protection Officer - what exactly should I do (if anything)?</p>
</blockquote>
<p>Demand and get proper training or resign. Don’t take legal responsibility for doing a job you don’t know how to do.</p>
<p>This is not a criticism of you or your skills - your employer should not have put you in this position.</p>

<blockquote>
<p>if the company is registered in the UK, then if I were to seek legal advice, I must turn to UK lawyer or any lawyer in EU could do that?</p>
</blockquote>
<p>It would be best to seek the services of a UK lawyer because any enforcement action against the company would typically be taken by the UK's GDPR regulator: the Information Commissioner's Office.</p>

gdpr