Check if your external data is reachable

In the evolving landscape of financial services, maintaining control over processed data is a critical concern for banks and insurance companies. Regulatory bodies across the globe, such as the Central Bank of the UAE and the European Banking Authority, expect businesses to have provisions for data access in their outsourcing arrangements.

This is particularly important for regulated industries, like those in the EU under the EU Data Act and related financial supervisory laws. These regulations necessitate that banks and insurance companies include contractual provisions with service providers that ensure uninterrupted access to and control over processed data, even after contract termination. This is to uphold data sovereignty and comply with strict regulatory requirements regarding data access, storage, and processing.

Effective data access provisions in outsourcing and technology contracts need to address multiple types of data access, including direct access and conditional access. In a SaaS arrangement, customers should be able to view and download their data during the term of the contract. In a business process outsourcing arrangement, the contract should provide for data to be made available promptly on request and without additional cost to the customer.

If service provider personnel are using third-party platforms, the contract should address the third party's commitments for continuous access, contingency arrangements for accessing data, and the possibility of contracting directly with the third-party platform provider.

In the event of service disruptions, access to data held by service providers is crucial for businesses to maintain operations and transfer data to new providers, if necessary. This underscores the importance of having appropriate business continuity and exit arrangements in place, including provisions for accessing data held by service providers.

Escrow arrangements can be a useful mechanism to support data access in stressed exits from a service provider, even where the customer does not require long-term access to the platform itself. These arrangements can ensure access to data in the event of service provider insolvency or other issues, with two main types: "access" and "replicate" models.

The "access" model provides access to the latest version of the code, environment, and data, but may not be suitable in multi-tenanted environments or if there are issues with the underlying environment. The "replicate" model, where the escrow provider sets up a mirrored instance of the cloud-based software, requires regular updating of the code and data in the replicated instance.

Businesses critically impacted by the loss of access to data on a cloud-based platform may wish to investigate escrow as a potential mitigation strategy. However, most SaaS contracts allow for data extraction on termination, but a minimum exit period might be necessary to replace the platform in case of an unplanned exit.

UK banks, insurers, and other financial entities regulated by the PRA must include provisions in their material outsourcing agreements regarding the accessibility and availability of data. Business process outsourcing agreements should contain detailed exit planning provisions for the transfer of outsourced services, including data migration.

In summary, maintaining control over data is a key concern for financial institutions, and regulatory bodies are increasingly demanding that businesses have robust provisions in place to ensure data access and control, particularly in the event of contract termination or service disruptions. Escrow arrangements and detailed exit planning provisions can provide valuable protection in these situations.