{"id":186573,"date":"2024-03-09T19:16:26","date_gmt":"2024-03-09T19:16:26","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=186573"},"modified":"2024-03-26T02:57:18","modified_gmt":"2024-03-26T02:57:18","slug":"data-processor-due-diligence","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/data-privacy-it\/data-processor-due-diligence\/","title":{"rendered":"What Is Data Processor Due Diligence?"},"content":{"rendered":"\n

The UK General Data Protection Regulation (UK GDPR<\/strong>) prescribes strict legal rules which apply when organisations share personal data. Where a data controller shares personal data with a data processor, a fundamental rule is to ensure the processor has appropriate safeguards to safeguard personal data.  The due diligence exercise aims to determine whether the relevant processor has safeguards to protect personal data. This article will explore the concept of data processor due diligence and some key questions to ask as part of this process. <\/p>\n\n\n\n

What Is the Relationship Between a Controller and a Processor?<\/h2>\n\n\n\n

If your organisation processes personal information, you will do so as either a data \u2018controller\u2019 or a data \u2018processor\u2019.  <\/p>\n\n\n\n

A data controller has most obligations under the UK GDPR<\/a>, as a controller is an organisation that decides how and why personal data is processed. In contrast, a processor\u2019s obligations are more limited. A processor is a separate organisation that processes personal data on the strict instructions of a data controller.<\/p>\n\n\n\n

Controllers and processors need to follow strict legal rules when sharing personal data. In particular, the parties must enter into a mandatory agreement that sets out data processing terms. The agreement<\/a> is vital to safeguard the personal data a controller shares with a processor.\u00a0\u00a0<\/p>\n\n\n\n

It is also vital for data controllers to carry out due diligence on their data processors, as explored further below. <\/p>\n\n\n\n

Why Is Due Diligence Important for Compliance?<\/h2>\n\n\n\n

Controllers need to carry out due diligence on any intended data processors. Due diligence allows the controller to guarantee whether the processor will implement appropriate technical and organisational measures to meet the UK GDPR requirements. <\/p>\n\n\n

\n \"Front\n
\n
GDPR Essentials Factsheet<\/div>\n
\n

This factsheet sets out how your business can become GDPR compliant.<\/p>\n <\/div>\n \n\nDownload Now<\/a> <\/section>\n <\/div>\n\n\n\n\n

Let us explore a practical example:<\/p>\n\n\n\n

Your business is a marketing firm that hires several staff members. You cannot support IT queries internally, so you seek to outsource to an IT supplier. The supplier will act as a data processor with limited access to your staff details. For example, they can call or email your staff to resolve their IT queries. As the supplier will access your staff data, you must ensure they will do so lawfully and by UK GDPR rules. For instance, what will happen if the supplier causes a data breach and your staff details are leaked? What security measures have the supplier put in place to prevent such risks? Can you trust them with your staff data? Due diligence will help you assess this. <\/p>\n\n\n\n

If your business is a data controller<\/a>, due diligence on your processor is vital to UK GDPR compliance. Due diligence will help you assess various legal and practical factors. For instance, you can gauge:<\/p>\n\n\n\n