HR Data Hosting Abroad: What Companies Need to Know

HR in the digital revolution

Today more than ever, companies are under pressure to organise their HR processes more efficiently with modern IT solutions. While in-house servers and internal IT departments used to be the norm, the trend is increasingly shifting to the cloud. Cloud solutions are impressive due to their flexibility, scalability and easy accessibility, and will soon make traditional on-premise solutions the exception.

In HR in particular, the choice of local and international providers is huge. This opens up numerous opportunities for companies of all sizes to reorganise their HR system landscape. Hosting of HR data abroad is becoming increasingly important and is becoming a strategic decision for many organisations.

Advantages of cloud solutions

Cloud hosting has become the standard in recent years – with good reason. Four advantages in particular stand out which make day-to-day HR work perceptibly easier and open up new opportunities.

1) Flexibility and scalability

Cloud systems are significantly more flexible and scalable than on-premise solutions. Companies can adapt their resources to current requirements at any time without having to invest in expensive infrastructure. This means that market changes and internal requirements can be managed quickly and easily. Many providers operate internationally and run their data centres abroad.

2) Cost reduction

Cloud hosting significantly reduces expenditure on hardware, maintenance and updates. Instead of investing in their own servers and IT staff, companies pay predictable licence or subscription fees. This makes budget planning easier, prevents unexpected costs and eliminates the need for expensive hardware updates.

3) Accessibility and collaboration

With cloud solutions, data and applications are available at any time and from anywhere – all you need is an internet connection. This facilitates collaboration across locations, increases productivity and supports flexible working. At the same time, VPNs, firewalls and other security mechanisms ensure protected access.

4) Security and data backup

Professional cloud providers invest heavily in the security and availability of data. Encryption, penetration tests, intrusion detection systems and regular backups are standard. This enables companies to achieve a level of protection that would often be difficult to implement internally. They can also specifically outsource operation and monitoring of the security infrastructure to the provider.

Data protection in focus

Data protection is – quite rightly – one of the most discussed HR topics. Companies and cloud providers must comply with the requirements of the Swiss Data Protection Act (DPA) and, where relevant, the EU General Data Protection Regulation (GDPR). Outsourcing data to third parties, especially in the cloud, may seem complex, but it can be summarised simply: entrepreneurs who use a cloud provider utilise a subcontractor. As a rule, they have access to sensitive company data, especially personnel data in the field of HR. Despite outsourcing, however, the company remains primarily responsible for the security of the data. In data protection, it is referred to accordingly as the "controller". An agreement with the cloud provider must therefore precisely define which data may be processed, for what purpose and to what extent. Even mere storage, for example, is considered data processing under the FDAP and GDPR. 

Hosting in the EU vs. third countries

The market for cloud solutions is strongly international in nature. This means that data is often processed outside of Switzerland, when it is stored or sent, for example. A distinction must be made here between whether hosting takes place in the EU or in a so-called third country.

Hosting in the EU:

If data is stored in the EU, the GDPR protection mechanisms automatically apply – regardless of where the responsible company is based. The decisive factor is where the data is actually processed. As this is Swiss employee data, the Swiss Data Protection Act also applies. IMPORTANT: In this case, only the GDPR protective mechanisms apply. It does not automatically apply in full to the company, even if this is often feared. However, contracting parties may agree that the Swiss company shall also be fully subject to the GDPR.

Hosting in third countries:

Particular caution is recommended if data is hosted outside Switzerland/EU. The high standards of the FADP or GDPR do not generally apply there. An appropriate level of data protection must therefore be contractually guaranteed. The country directories of the Federal Office of Justice and the EU Commission, which list countries with a recognised high level of protection, provide guidance. It is no coincidence that the EU lists Switzerland while Switzerland lists the EU member states – both laws are very similar in their high standards.

Summary

Hosting HR data abroad has long been a reality for many companies. Large market leaders dominate; innovative start-ups keep things moving. Cloud solutions open up enormous opportunities but require conscious handling of sensitive personal data, which can quickly become confusing, especially with multiplication of numerous cloud solutions. Clarity about the data's location and the applicable data protection laws is essential – whether for international cloud hosting or the classic paper file in the cupboard.