Data Privacy
Definition
Data Privacy
Data privacy is the rules and practices governing how personal information is collected, used, shared and retained. Privacy asks whether the data should be held at all, while security asks whether it is held safely, and the two are not interchangeable.
That distinction decides where responsibility sits. A perfectly secured database of information collected without a lawful basis is a privacy failure — with no security component at all.
The obligations are statutory rather than optional. Different jurisdictions impose different rules, and the applicable one usually follows the individual rather than the processor.
Outsourcing makes the question concrete. Moving work offshore moves personal data across a border, and that transfer is itself a regulated act in most frameworks.
Key takeaways
- Privacy governs whether and why data is held; security governs how well it is protected.
- Obligations usually follow the individual’s location, not the processing team’s.
- Cross-border transfer is a regulated act in its own right.
- Responsibility for compliance stays with the organisation that collected the data.
How it works
Privacy regimes share a common architecture. They define personal data, require a lawful basis for processing it, limit use to the purpose stated at collection, cap retention, and give individuals rights over their own records.
Purpose limitation is the principle most often broken in practice. Data gathered for one reason gets reused for another — and the second use is frequently the one that was never disclosed.
Accountability does not transfer with the work. Where a provider processes data on a client’s behalf, the client remains answerable to regulators — and to the individuals concerned.
Cross-border transfer carries its own machinery. Adequacy decisions, standard contractual clauses and certification frameworks exist precisely because moving data between jurisdictions is treated as a distinct regulated act.
That machinery is unstable by design, and arrangements have been struck down.
The Federal Trade Commission records that the European Court of Justice invalidated the Privacy Shield adequacy decision on 16 July 2020, with the EU-US Data Privacy Framework receiving its adequacy decision on 17 July 2023.
Formal guidance treats privacy as a risk discipline, not a legal checkbox. The National Institute of Standards and Technology publishes a Privacy Framework as a voluntary enterprise risk management tool, currently at version 1.0 with version 1.1 in draft.
Each jurisdiction publishes its own operative text. The Philippine National Privacy Commission hosts the Data Privacy Act of 2012 and its implementing rules, and the United Kingdom’s regulator publishes its own guidance on the UK GDPR.
| Concern | Privacy question | Security question |
|---|---|---|
| Collection | Is there a lawful basis? | Is the channel protected? |
| Use | Does it match the stated purpose? | Who can access it? |
| Retention | Should it still be held? | Is it encrypted at rest? |
| Transfer | Is the destination permitted? | Is it protected in transit? |
Examples
Privacy obligations bite differently depending on who the data is about and where they live. The cases below show the rule following the individual rather than the operation.
A European retailer outsourcing support to Asia exports personal data on EU residents. The transfer needs a lawful mechanism, and the retailer stays accountable for the provider’s handling of it.
A Philippine provider handling local consumer records falls under Philippine law regardless of its client’s location. Two regimes can therefore apply to one operation at the same time.
A contact centre recording calls for quality monitoring processes personal data twice over. Both the recording and its retention need a basis, and indefinite retention is the common failure.
An analytics team reusing support records to train a model faces a purpose question rather than a security one. The data is held legitimately; the new use may not be covered by the original notice.
Related terms
Privacy is governed by instruments that vary by jurisdiction, and several entries below cover a specific regime. The distinctions keep the general discipline separate from any one statute.
- Data Privacy Act Philippines: the Philippine statute governing personal information processing.
- GDPR General Data Protection Regulation: the European regime that set the template most later laws follow.
- GDPR Outsourcing: the application of European rules to work performed by an external provider.
- Data Privacy Program: the internal operating structure that implements privacy obligations.
- Data Residency Clause: the contract term fixing where data may physically be stored.
- Data Localization Outsourcing: delivery arranged to keep data inside a required jurisdiction.
FAQ
What is the difference between data privacy and data security?
Privacy governs whether data should be collected, used and retained at all. Security governs how well it is protected. Strong security cannot cure an unlawful collection.
Which country’s rules apply to offshore processing?
Usually those covering the individuals the data describes, not only those where processing happens. Two regimes commonly apply to one operation simultaneously.
Does signing a contract transfer privacy responsibility?
No. A contract allocates obligations between the parties, but accountability to regulators and individuals stays with the organisation that collected the data.
Can personal data be processed offshore at all?
Yes, where a lawful transfer mechanism is in place and the provider is bound to equivalent obligations.
What is the most common privacy failure in outsourced work?
Retaining data long after the purpose that justified collecting it has ended.
Is anonymised data still personal data?
Only if it can be re-identified.
Review providers and their data handling practices through Outsource Accelerator before moving regulated work offshore.
Independent
