{"id":187262,"date":"2024-04-17T14:46:39","date_gmt":"2024-04-17T13:46:39","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=187262"},"modified":"2024-04-17T14:46:42","modified_gmt":"2024-04-17T13:46:42","slug":"data-sub-processor","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/data-privacy-it\/data-sub-processor\/","title":{"rendered":"What Is a Data Sub-Processor?"},"content":{"rendered":"\n

The UK General Data Protection Regulation (UK GDPR<\/strong>) is the fundamental law in the UK regulating the use of personal data. Under this law, various rules exist for different parties in a data processing relationship. It is common for data processors to engage the assistance of further processors, commonly known as ‘data sub-processors’. However, data processors should note several data protection compliance considerations apply when engaging third-party sub-processors. This article will explore what a data sub-processor is and critical considerations for data processors regarding their use.<\/p>\n\n\n\n

What Is a Sub-Processor’s Role?<\/h2>\n\n\n\n

Understanding the roles of data controllers and data processors within the UK GDPR framework is crucial. This distinction is vital for understanding each party’s role in accountability when processing personal data caught within the scope of the UK GDPR<\/a>. <\/p>\n\n\n\n

While data controllers are responsible for determining the purposes and means of processing personal data, data processors process personal data on behalf of the controller. <\/p>\n\n\n

\n \"Front\n
\n
GDPR Essentials Factsheet<\/div>\n
\n

This factsheet sets out how your business can become GDPR compliant.<\/p>\n <\/div>\n \n\nDownload Now<\/a> <\/section>\n <\/div>\n\n\n\n\n

A ‘data sub-processor’ is a third party that a data processor engages to assist with personal data processing on behalf of the controller. Data processors typically engage them to process the data controller’s data for specific purposes.\u00a0<\/p>\n\n\n\n

For example, a data processor may engage a cloud storage provider to store personal data, which it processes on behalf of a data controller customer. In such cases, the cloud storage provider acts as a sub-processor, processing personal data on the controller’s behalf through the data processor’s instructions. <\/p>\n\n\n\n

What Are Some Key Considerations for Sub-Processor Relationships?<\/h2>\n\n\n\n

If your business processes data as a processor, there are vital issues to note when engaging a third-party subprocessor. <\/p>\n\n\n\n

Three of the critical issues to consider, amongst others, are as follows:<\/p>\n\n\n\n

Have You Carried Out Due Diligence?<\/h3>\n\n\n\n

Appointing a sub-processor is a high risk. Processors should safeguard themselves from liability by conducting detailed due diligence on potential sub-processors to ensure compliance with UK GDPR data processing standards. <\/p>\n\n\n\n

\n

This includes assessing their measures for preventing unauthorised data processing and loss, their technical security procedures, data destruction procedures, internal controls for managing data security risks and employee training.<\/p>\n<\/div>\n\n\n\n

Processors should precisely document their due diligence efforts, conduct regular audits or reviews, and maintain records of all data categories processed by sub-processors so they are readily available for data protection regulators upon request.<\/p>\n\n\n\n

Have You Obtained Authorisation from the Controller?<\/h3>\n\n\n\n

The UK GDPR imposes strict rules on sub-processors’ engagement by processors, requiring prior written authorisation from the controller, either specific or general.\u00a0 If granted general authorisation, the processor must notify the controller of any changes, offering the controller the opportunity to object.<\/p>\n\n\n\n

For practical purposes, contractual agreements between controllers and processors often grant the processor the authority to appoint sub-processors. At the same time, the controller retains the right to reject these third parties and terminate the contract if they are unhappy with their appointment.\u00a0<\/p>\n\n\n\n

Have You Put in Place a Sub-Processor Agreement?<\/h3>\n\n\n\n

A processor must impose identical data protection obligations on sub-processors as specified in the contract between the controller and the processor and ensure that the sub-processor (SP) only processes personal data per the controller’s instructions.\u00a0<\/p>\n\n\n\n

Further, the original processor remains fully liable to the controller for the SP’s performance, necessitating thorough due diligence on them before engagement to ensure the meeting of contractual obligations. As such, parties require formal sub-processor agreements to reflect the obligations to ensure UK GDPR requirements where an SP is engaged.\u00a0<\/p>\n\n\n\n

You should carefully draft sub-processing agreements to accurately reflect the specific data processing agreement<\/a> and safeguard the initial processor from risk.  <\/p>\n\n\n\n

In summary, various issues exist when a processor intends to engage an SP. If you require support understanding these obligations, you should seek legal advice<\/a> from an experienced data protection solicitor.\u00a0<\/p>\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\n

\n
\n Need legal advice?\n
\n \n Call 0808 196 8584<\/a> for urgent assistance.\n
\n Otherwise, complete this form, and we will contact you within one business day.\n <\/span>\n <\/div>\n\n \n\n
\n