The lack of group privilege poses challenges for group companies. Outsourcing certain corporate areas (e.g., accounting, human resources management or payroll) and centralizing data processing at the group parent will not be possible without further ado.
When introducing and using a group database, it must be clarified, for example, which company is actually “responsible” or whether “joint responsibility” between the participating group companies can even be considered. Under certain circumstances, commissioned processing may also be considered. In addition, companies are under an obligation to base each intra-group transfer of personal data on a valid legal basis. If a group company involved is located in a third country, additional requirements have to be fulfilled. If the group company independently processes employee data that it receives from a group company from the EEA area, the standard contractual clauses provided by the European Commission require supplementary regulations for data protection-compliant data transfer of employee data.