{"id":184858,"date":"2023-12-06T00:50:42","date_gmt":"2023-12-06T00:50:42","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=184858"},"modified":"2023-12-06T02:48:04","modified_gmt":"2023-12-06T02:48:04","slug":"data-protection-indemnity","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/data-privacy-it\/data-protection-indemnity\/","title":{"rendered":"What is a Data Protection Indemnity?"},"content":{"rendered":"\n

Liability provisions under data processing agreements<\/a> are a common negotiation topic for businesses. A customer sharing personal data with a third-party supplier commonly requests a data protection indemnity to protect their business from risk. In this article, we will explore what a data protection indemnity is and some of the key issues to note around data protection indemnities. <\/p>\n\n\n\n

What is a Data Processing Agreement?<\/h2>\n\n\n\n

A data processing agreement is an agreement between a data controller and a data processor under which the data controller shares personal data with the data processor. This document is mandatory under the UK General Data Protection Regulation<\/a> (\u2018UK GDPR\u2019). <\/p>\n\n\n\n

A data controller<\/strong> is a person or organisation that decides how and why to collect and use personal data. On the other hand, a data processor<\/strong> is a separate person or organisation that processes personal data on the controller\u2019s behalf and by following their instructions.<\/p>\n\n\n\n

In business, data controllers commonly share personal data with third-party processors who act on their behalf to process personal data. For example, companies often use external IT services suppliers to help them with IT support. The suppliers often have access to staff and customer data to help individuals with their IT queries. Additionally, companies often use external payroll suppliers, who will use staff details to run payroll services to pay staff. <\/p>\n\n\n\n

\n

In these scenarios, the companies will need a data processing agreement if the third party suppliers will have access to personal data. This is because data protection law requires the parties to enter into a written agreement setting out each party\u2019s obligations under the UK GDPR.<\/p>\n<\/div>\n\n\n\n

A data processing agreement must contain various clauses around the data processor\u2019s responsibility to protect personal data. For example, clauses around keeping personal data secure and confidential. <\/p>\n\n\n

\n \"Front\n
\n
GDPR Essentials Factsheet<\/div>\n
\n

This factsheet sets out how your business can become GDPR compliant.<\/p>\n <\/div>\n \n\nDownload Now<\/a> <\/section>\n <\/div>\n\n\n\n\n

What is a Data Protection Indemnity?<\/h2>\n\n\n\n

As part of data processing agreement negotiations, the apportionment of liability is a crucial issue. Indemnities are clauses to address specific known risks under a contract. <\/p>\n\n\n\n

An indemnity is a promise one party gives (the indemnifying party<\/strong>) to pay the other party (the indemnified party<\/strong>) for a specific loss they suffer under the contract if a trigger event occurs. The contract should explain what the trigger event is. It could be the indemnifying party\u2019s: <\/p>\n\n\n\n