I work for a small non-EU company1 on projects of a British company2 which rents out houses.
All the live databases3 are located in the UK on their premises and we access those databases and servers only for deploying new codebase.
The data that they collect (With consent of their employees and customers) contains:
- Firstname, lastname, phone numbers, emails, gender, sexual orientation, race, religion etc
- Criminal and/or Abusive records
- Disability records
- Employment Records
Also, they do not delete the data of previous customers. The former customers remain in the records as "Prospective Customers".
We could access all that data on the live server if we wanted to, using our deployment accounts but we usually don't unless there's a live issue and we have to access the logs etc for debugging. The bottomline is, we don't collect any data that we store in Asia or our local databases. All the data that's gathered is collected by a British firm and saved in British Databases located in Britain.
We get paid for deploying our codebase to the live server but now they have cut off our access to Live Server, citing GDPR which means we can no longer deploy the code on live servers and won't get paid for it.
Are there any provisions in the GDPR for collaboration between EU and non EU companies on projects which handle data of EU citizens? Are there any conditions, meeting which would make us eligible to access the live server with real data of EU citizens?
1. Our 'headquarters' is in VA, USA, quotes because it isn't really our HQ, it's just our Marketing and Business department who get the projects which are then developed in Asia. Our British clients are aware of this arrangement and have been working with us for 11 years now.
2. Semi-Public? They do receive public funding and are owned in part by the government
3. The ones with real data, not the ones with dummy data for testing
Disclaimer: This is an anon account I created specifically for this question. My main profile has information that can be traced back to my workplace and given the government involvement in our partner company, that might be troublesome. Rest assured, I won't be upvoting this via my main profile which doesn't even have a Law SE account.