How does amaise meet international data protection requirements?
amaise, as a data processor, complies with the requirements of the relevant data protection regulations:
GDPR (EU General Data Protection Regulation):
Data processing agreement (DPA): Compliant with Art. 28 GDPR, signed as part of the contract. The DPA covers subprocessors, data categories, processing purposes, retention periods, and security obligations.
Data subject rights: Supports access, rectification, erasure, data portability, and restriction of processing.
Record of processing activities (ROPA): Maintained and updated.
Data protection impact assessments (DPIA): Conducted for high-risk processing.
Breach notification: Report to supervisory authority within 72 hours (Art. 33), notify data subjects in case of high risk (Art. 34).
Subprocessors: Changes are communicated in advance, right to object granted according to Art. 28.
International data transfers: US-based services (that do not process customer document contents) are secured by Standard Contractual Clauses (SCCs).
Swiss nDSG: Full compliance with the new Swiss data protection law — data residency in Switzerland (AWS Zurich), reporting obligation to the FDPIC, compliance with Art. 321 StGB (professional secrecy). Details: see nDSG compliance.
US data protection: amaise supports US customers with data residency in the USA (AWS Ohio), compliance with applicable State Privacy Laws and industry-specific requirements. For healthcare customers, relevant security controls are operated in line with HIPAA requirements.