Today we are incredibly proud to announce that QXAS has become the 1st accounts outsourcing company in India to be GDPR compliant!
Our delivery centers met with the requirements of GDPR on 26 April 2018 via the British Standards Institution’s 10012:2017 framework. We were awarded the standard exactly a month before the deadline comes into effect!
What is BS 10012:2017 Personal Information Management System?
Developed by the British Standards Institute (BSI), BS 10012:2017 is a UK standard which sets out the requirements for a personal information management system (PIMS).
It is the only available code of conduct which aligns with the principles of GDPR, outlining the core requirements organisations need to consider when collecting, storing, processing, retaining or disposing of personal records associated to individuals.
Our Commitment to Security and Regulatory Compliance
One of the challenges every outsourcing company faces is establishing trust with their clients. Getting the BS 10012:2017 compliance framework enables QX to demonstrate to our clients the maturity of our information security systems via an independent third party attestation. It also validates the measures we have taken to enable security, confidentiality, and availability of our customer data.
The BSI auditors had this to say after the certification was issued:
"At this stage where most of the companies have just started their GDPR journey, such a mature and well drafted framework at QX is a proof of how ahead you are in the game. We had a difficult time finding a flaw in your system. The level of competency of people, the detailing of documentation and the involvement of people is commendable. It was a learning experience for us too and we wish you all the best for the future” – British Standards Institution
Why is a GDPR compliant outsourcing partner important for you?
GDPR impacts data processers and data controllers alike, making it imperative for outsourcing companies as data controllers to ensure that their dat aprocessing activities are carried out in accordance to the principles set forth in the GDPR.
Non-compliance can result in fines of up to 20 million euros or 4% of the total annual turnover of the preceding financial year, whichever is higher. The risk of fines isn’t just the amount, non-compliance will also lead to reputational, operational and regulatory risks.
Article 28 “Requirements of a Data Processor” mandates that a data controller shall use only those processors that provide sufficient guarantees to implement appropriate technical and organisational measures.
How did we become GDPR compliant?
Data security has always been of paramount importance to us, but GDPR makes the security and privacy aspects even more important. Businesses, both data controllers as well as data processers, need to meet a whole list of requirements to demonstrate GDPR compliance. They have to commit to enhancing their data inventory and mapping processes, revising written data processing agreements (DPAs), appointing a data protection officer (DPO), and putting a Data Protection Impact Assessment (DPIA) policy in place.
To become GDPR compliant via the BS 10012:2017 framework, we have implemented the following features:
[QX's BSI certified GDPR team]
As the 1st GDPR compliant, accounts outsourcing in India, we want our accounting clients to be confident in knowing that we’ve taken all the necessary steps to not only keep their data secure but to only collect and hold what is required.
We are also committed to help our clients prepare for the obligations under GDPR. If you have any specific questions regarding the GDPR requirements and how this may impact your use of QXAS please email us on email@example.com and our GDPR team will respond.
Give QXAS accounts outsourcing a try. Get started with a non-obligatory 10-hour free-trial.
Source: QX Ltd
Andrew is the Communications Director at Solutio (UK) Limited and carries years of experiences in the recruitment and payroll industry. Apart from work, he also takes time out to follow his passions for music, travel, design, interiors and what he likes to call “a random array of subjects that catch the eye.” Being an avid writer, he profusely documents his experiences in his writings.