Under what conditions can an Asian company access Database hosted by a British company containing data of European citizens?

Question

I work for a small non-EU company¹ on projects of a British company² which rents out houses.

All the live databases³ are located in the UK on their premises and we access those databases and servers only for deploying new codebase.

The data that they collect (With consent of their employees and customers) contains:

1. Firstname, lastname, phone numbers, emails, gender, sexual orientation, race, religion etc
2. Criminal and/or Abusive records
3. Disability records
4. Employment Records
5. Income

Also, they do not delete the data of previous customers. The former customers remain in the records as "Prospective Customers".

We could access all that data on the live server if we wanted to, using our deployment accounts but we usually don't unless there's a live issue and we have to access the logs etc for debugging. The bottomline is, we don't collect any data that we store in Asia or our local databases. All the data that's gathered is collected by a British firm and saved in British Databases located in Britain.

We get paid for deploying our codebase to the live server but now they have cut off our access to Live Server, citing GDPR which means we can no longer deploy the code on live servers and won't get paid for it.

Are there any provisions in the GDPR for collaboration between EU and non EU companies on projects which handle data of EU citizens? Are there any conditions, meeting which would make us eligible to access the live server with real data of EU citizens?

---

_{1. Our 'headquarters' is in VA, USA, quotes because it isn't really our HQ, it's just our Marketing and Business department who get the projects which are then developed in Asia. Our British clients are aware of this arrangement and have been working with us for 11 years now.}

_{2. Semi-Public? They do receive public funding and are owned in part by the government}

_{3. The ones with real data, not the ones with dummy data for testing}

Disclaimer: This is an anon account I created specifically for this question. My main profile has information that can be traced back to my workplace and given the government involvement in our partner company, that might be troublesome. Rest assured, I won't be upvoting this via my main profile which doesn't even have a Law SE account.

Answer 1

The GDPR doesn't talk about specific technologies used to access data. You are processing data of EU citizens, which is controlled by a UK company. They of course have their own obligations (as mentioned in the comments). But as a processor, your company needs to follow the GDPR rules. The chief bit here is article 28, which defines what a processor is under GDPR rules.

For instance, the contract with a processor must be subject to the laws of an EU Member State. You stated in the comments you believed you were not subject to those laws. If that indeed is the case, then the UK company is correct, you are not GDPR compliant, and may not access the live server.

To address the specific part of the question about working with non-EU companies: under article 45, it's noted that the EU can designate certain countries which have compatible data protection laws (adequacy decision), but otherwise you'd need article 46 - are there appropriate legal safeguards in your (Asian) country? This is not a question you can answer yourself, it must be answered by the supervisory authority (in the UK: ICO).