{"id":187971,"date":"2024-05-15T18:58:41","date_gmt":"2024-05-15T17:58:41","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=187971"},"modified":"2024-05-15T18:58:44","modified_gmt":"2024-05-15T17:58:44","slug":"controllers-consent-engage-data-sub-processor","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/data-privacy-it\/controllers-consent-engage-data-sub-processor\/","title":{"rendered":"Do I Need a Controller’s Consent to Engage a Data Sub-Processor?"},"content":{"rendered":"\n

The UK General Data Protection Regulation (UK GDPR<\/strong>) sets strict requirements for processing personal data. Under the UK GDPR regime, various rules apply when a processor engages another subprocessor to process a controller’s data. A vital issue is whether the processor can appoint a subprocessor freely or if the controller’s consent is necessary. This article explores whether a processor needs a controller’s permission to engage a subprocessor. <\/p>\n\n\n\n

What is the Difference Between Controllers, Processors and Sub-Processors?<\/h2>\n\n\n\n

Understanding the differences between controllers, processors, and subprocessors is fundamental to ensuring an organisation understands the complex legal rules governing data processing under the UK GDPR<\/a>. <\/p>\n\n\n\n

A controller is an organisation with the authority to determine the purposes and methods of personal data processing. At the same time, a processor undertakes this on behalf of and according to the controller’s instructions. Subsequently, sub-processors are organisations engaged by processors to aid in specific data processing activities on behalf of the controller. For instance, a service provider who is a processor may engage a sub-processor<\/a> to deliver hosting or cloud services as part of the customer controller’s project. <\/p>\n\n\n

\n \"Front\n
\n
GDPR Essentials Factsheet<\/div>\n
\n

This factsheet sets out how your business can become GDPR compliant.<\/p>\n <\/div>\n \n\nDownload Now<\/a> <\/section>\n <\/div>\n\n\n\n\n

The UK GDPR imposes significant obligations on controllers to ensure compliance, including selecting processors who can guarantee adequate technical and organisational measures to safeguard data. Understanding this obligation and the parties’ roles in a data processing chain is crucial.<\/p>\n\n\n\n

Does a Controller Need to Give Permission for Use of Sub-Processors?<\/h2>\n\n\n\n

Securing authorisation from the controller is a crucial step under the UK GDPR when engaging subprocessors. This means receiving written permission beforehand for each subprocessor or as general approval. If permission is based on general authorisation, any changes to sub-processors must be communicated to the controller, giving them a chance to object. This is vital for processors to understand. We explore this further below. <\/p>\n\n\n\n

Under the UK GDPR, specific requirements apply to ensure accountability regarding data sub-processors. <\/p>\n\n\n\n

\n

Article 28 of the UK GDPR specifies various conditions for engaging data processors, including the need for a written contract that clearly defines processing activities, types of personal data, data subject categories, and the rights and obligations of both the controller and processor.<\/p>\n<\/div>\n\n\n\n

Significantly, this article of the UK GDPR dictates that the data processor must obtain prior written authorisation, whether specific or general, before engaging a sub-processor. This highlights the controller’s responsibility for overseeing and being accountable for all processing activities. Ultimately, the controller must be fully informed and retain control over data processing, including when involving sub-processors, to ensure compliance with the UK GDPR.<\/p>\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\n

\n
\n Need legal advice?\n
\n \n Call 0808 196 8584<\/a> for urgent assistance.\n
\n Otherwise, complete this form, and we will contact you within one business day.\n <\/span>\n <\/div>\n\n \n\n
\n