Suppliers of services often (although not always) act as data processors on behalf of their customers. A data processor is an organisation that processes personal data on behalf of a data controller. Where a supplier processes personal data on behalf of their customer, various stringent legal rules apply. In particular, the parties must enter mandatory data processing terms. This article will explore how to ensure that your services agreement is UK GDPR compliant if you act as a data processor. <\/p>\n\n\n\n
Data processing terms are mandatory in certain circumstances under the General Data Protection Regulation (UK GDPR<\/strong>)<\/a> law rules. The UK GDPR is the primary UK law governing rules on how organisations use personal data. <\/p>\n\n\n\n Article 28 of the UK GDPR prescribes various mandatory terms that a data controller and data processor must enter into.<\/p>\n\n\n\n These terms include various obligations, including:<\/p>\n\n\n\n The key objective of these terms is to safeguard and protect personal data shared between controllers and processors. <\/p>\n\n\n\n These terms can be set out in a services agreement or a standalone data processing agreement<\/a>. <\/p>\n\n\n\n Data processing terms are vital mandatory requirements and not optional for businesses. As such, the obligation to put data processing terms in place is fundamental. <\/p>\n\n\n\n From the outset, your supplier business must determine whether you act as a data processor on behalf of your clients. <\/p>\n\n\n\n The key definitions to consider are \u2018data controller\u2019 and \u2018data processor\u2019. <\/p>\n\n\n\n To summarise each role:<\/p>\n\n\n\n You must determine whether you act as a data processor for each customer relationship and project. If so, the UK GDPR requires you to have a written contract in place to govern the data processing relationship. <\/p>\n\n\n\n As a supplier, you should consider key questions, including:<\/p>\n\n\n\n Suppose it turns out that you will have any elements of control over a customer\u2019s personal data. In that case, it may be that you are, in fact, also a data controller, which means separate rules and data-sharing terms may be necessary. <\/p>\n\n\n\n Determining whether you are a processor requires careful analysis. It will determine the contractual terms you need in place and other wider UK GDPR rules you need to comply with. <\/p>\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\n\n
Are You a Data Processor?<\/h2>\n\n\n\n
\n
\n