The UK GDPR prescribes very stringent rules around sharing personal data with third parties. Whenever your business shares personal data, mandatory rules apply. For instance, you will need to obtain a UK GDPR-compliant data processing agreement before you share the data. This article will explain what a Data Processing Agreement is and the key provisions it should cover. <\/p>\n\n\n\n
The definition of ‘data controller’ and ‘data processor’ are fundamental concepts under the UK GDPR rules. Whether an organisation is a data controller or data processor will determine its responsibilities under the UK GDPR<\/a>. A data controller is a party that decides how and why to collect and use personal data. On the other hand, a data processor is a separate party that processes personal data on behalf of the controller and as per their instructions.<\/p>\n\n\n\n Often, data controllers will share personal data with third-party processors who act on their behalf in connection with personal data owned by the data controller.<\/p>\n<\/div>\n\n\n\n For example, an employer company is a data controller of its staff data, as it collects staff data and decides what to do with it. The company uses a third-party supplier to run payroll services, as it does not have the resources to do so in-house. The payroll company acts as a data processor, as it uses the employer\u2019s staff data to follow the strict instructions of the employer and provide a service. The third-party supplier does not decide how to use the personal data, so it needs to follow the rules set out in a data processing agreement with the employer.\u00a0<\/p>\n\n\n\n The UK GDPR states that a controller should only use a processor that provides sufficient guarantees that it will implement appropriate technical and organisational measures so that the processing will meet the requirements of the UK GDPR and safeguard data subject rights. Accordingly, data controllers must carry out thorough due diligence on intended service providers whom they wish to engage, where they will have access to their company’s personal data<\/a>. <\/p>\n\n\n\n Whenever a data controller uses a data processor, it is mandatory for the parties to enter into a written agreement (or another legal act) setting out each party’s obligations under the UK GDPR. This is vital to make sure that the personal data shared between the parties is always safeguarded. <\/p>\n\n\n\n Under the UK GDPR, Data Processing Agreements must contain certain specific provisions.<\/p>\n\n\n\n The agreement should include various terms, such as a description of the data processing, including the: <\/p>\n\n\n\nWhat is a Data Processing Agreement?<\/h2>\n\n\n\n
\n