Time zones are hard

app/services/imports/data_protection_confirmation_import_service.rb

@@ -30,7 +30,7 @@ module Imports
         data_protection_officer: dp_officer,
         old_id: record_field_value(xml_document, "id"),
         old_org_id: record_field_value(xml_document, "institution"),
-        created_at: record_field_value(xml_document, "change-date").to_time,
+        created_at: record_field_value(xml_document, "change-date").to_time(:utc),
       )
     rescue ActiveRecord::RecordNotUnique
       id = record_field_value(xml_document, "id")

spec/services/imports/data_protection_confirmation_import_service_spec.rb

@@ -43,7 +43,7 @@ RSpec.describe Imports::DataProtectionConfirmationImportService do
           confirmation = Organisation.find_by(old_org_id:).data_protection_confirmations.last
           expect(confirmation.data_protection_officer.name).to eq("John Doe")
           expect(confirmation.confirmed).to be_truthy
-          expect(confirmation.created_at).to eq(Time.zone.local(2018, 0o6, 0o5, 10, 36, 49))
+          expect(Time.zone.local_to_utc(confirmation.created_at)).to eq(Time.utc(2018, 0o6, 0o5, 10, 36, 49))
         end
       end
 
@@ -58,7 +58,7 @@ RSpec.describe Imports::DataProtectionConfirmationImportService do
           confirmation = Organisation.find_by(old_org_id:).data_protection_confirmations.last
           expect(confirmation.data_protection_officer.id).to eq(data_protection_officer.id)
           expect(confirmation.confirmed).to be_truthy
-          expect(confirmation.created_at).to eq(Time.zone.local(2018, 0o6, 0o5, 10, 36, 49))
+          expect(Time.zone.local_to_utc(confirmation.created_at)).to eq(Time.utc(2018, 0o6, 0o5, 10, 36, 49))
         end
 
         context "when the data protection record has already been imported previously" do