Data Privacy Framework - People Work Smart

General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) is the European Union law that protects people’s personal information, meaning anything that identifies someone, such as a name, contact details or account records. The UK version of GDPR, together with the Data Protection Act 2018, applies to People Work Smart because we handle information about people in the UK. In plain terms, the law says we must have a proper reason to use someone’s information, be open about how we use it, use only what we need, keep it secure, and be able to show we are doing all of this.

The law also sets strict rules about sending personal information to another country. Personal information can move freely to another country only if the UK or EU has formally decided that country protects data to an equivalent standard, a decision known as an “adequacy” finding. Because most PWS work is done from the Philippines, this is central to how we operate. The Philippines has no adequacy finding, which does not mean its protection is weak, only that no formal decision exists, so rather than relying on local law we put our own safeguards in place, a contract with specific data protection commitments backed by a check on the risks, so the information carries UK-level protection with it.

Roles & Responsibilities

GDPR sorts everyone who handles the information into roles, and each role carries different responsibilities. The client is the “Controller”: it owns the information, decides why and how it is used, and holds the legal reason for using it. PWS UK is the “Processor”: it handles the information only by following the client’s written instructions, which are set out in the contract between them (the Master Services Agreement). The work is then delivered with help from others, known as “Sub-Processors”.

PWS Philippines is the team that actually does the work, and PWS Australia provides IT support. When PWS Australia brings in a third-party service provider to help with that support, that company is one more step down the line, and it only ever sees client information by chance while fixing something, never as part of doing the work. Every link in this chain signs up to the same promises, so the protections the client is entitled to travel with the information all the way down. Separately, PWS keeps some business-contact details of its own in order to manage the relationship, and for that limited information PWS is the controller.

Types of Information

Two kinds of information run through all of this:

Client Data is the information the client owns and asks us to work with, for example details of its customers, enquiries and suppliers, and its sales, order and marketing records.
Group Data is the business-contact and account information PWS holds to coordinate the work between its offices.
Some information counts as especially sensitive, such as health records or anything about a person’s criminal history. We do not touch information like that unless the client has specifically asked us to, confirmed it has a proper legal reason (lawful basis), and we have agreed appropriate correct contractual terms & data processing arrangements.

Some information counts as especially sensitive, such as health records or anything about a person’s criminal history. We do not touch information like that unless the client has specifically asked us to, confirmed it has a proper legal reason (lawful basis), and we have agreed appropriate correct contractual terms & data processing arrangements.

The framework is built in three parts: setting the rules and signing the contracts; managing the risks of moving information between countries; and the day-to-day of doing the work and returning it to the client. The agreements named in it, the group data-sharing agreement, the transfer risk assessments and the international data transfer agreement, are simply the tools that make each cross-border step lawful.

The Framework

The framework is built in three parts:

The first is setting the rules and signing the contracts: a Global Privacy Policy that explains, across all our offices, how we handle information for everyone we deal with; the Master Services Agreement, the contract between the client and PWS UK that contains the specific data protection promises; and, where a client looks after its own computers, an optional Self-Managed Waiver that records this.
The second part manages the risks of moving information between countries: the Intra-Group Data Sharing Agreement, which holds our UK, Australian and Philippine offices to the same promises; a Transfer Risk Assessment for each cross-border flow (for example client data going to the Philippines) which checks the destination controls are safe enough; and the International Data Transfer Agreement, the contract between PWS UK, PWS Philippines and the client that makes each transfer lawful and lets the client enforce its protections directly.
The third part is the day-to-day: the PWS Philippines team acknowledges the privacy policy, performs the work, and returns the finished deliverables to the client.

For PWS as a group, GDPR is the reason all of this exists. Information about people in the UK and EU is protected more strictly than local law requires, so even a small number of these clients sets the standard the whole group works to, and that standard is passed on to everyone who handles the information.