A protection impact assessment examines how planned processing could affect people\u2019s rights and freedoms. Businesses often shorten these names to DPA and DPIA.UK business owners may need both documents when introducing a service that uses customer or staff information. You act as a controller when you decide why and how to use personal data. A processor handles that data on your behalf. You must put compliant contractual terms in place before a processor starts work. You must also complete a DPIA before processing that is likely to create a high risk to individuals. The documents address different duties, so completing one does not replace the other. This article explains when controllers need DPAs and DPIAs, their differences, and how to use both when appointing suppliers.<\/p>\n\n\n\n
You must comply with data protection rules when your organisation processes personal data. Personal data means information about an identified or identifiable living person. Processing includes collecting, storing, using and deleting that information.<\/p>\n\n\n\n
Your duties depend on the information you handle, your purposes and the risks to individuals. A payroll arrangement raises different practical questions from a service that tracks customer behaviour. Start with what your business actually plans to do.<\/p>\n\n\n\n
If you fail to meet your duties, the regulator may take enforcement action, including fines. You may also face disruption and lose customers\u2019 trust. Clear records and working safeguards help you explain and support your decisions.<\/p>\n\n\n\n
Your data protection compliance documents<\/a> should match your daily operations. A signed agreement cannot show whether staff follow access restrictions in practice.<\/p>\n<\/div>\n\n\n\n You must agree compliant processing terms whenever another organisation processes personal data on your behalf as a processor. Put the terms in place before the processing starts. Common examples include payroll providers, cloud storage suppliers and outsourced IT support.<\/p>\n\n\n\n Check the supplier\u2019s role for the relevant activity. Access to your data does not, by itself, establish that the supplier acts as your processor. The actual arrangement determines each organisation\u2019s responsibilities.<\/p>\n\n\n\n Before discussing contract wording, ask the supplier to describe how it will use the information. Compare that answer with your own instructions. Resolve any difference before treating the supplier as a processor for the activity.<\/p>\n\n\n\n Your DPA must describe the subject matter, duration, nature and purpose of the processing. It must identify the types of personal data and the categories of people involved. It must also set out your rights and obligations as controller.<\/p>\n\n\n\n The agreement must require the processor to follow your documented instructions, unless the law requires otherwise. It must require confidentiality commitments from authorised staff and appropriate technical and organisational security measures.<\/p>\n\n\n\n The processor must help you respond to individuals exercising their data rights. The contract must also cover support with security, handling personal data breaches<\/a> and DPIAs.<\/p>\n\n\n\n Include provisions for returning or deleting data at your choice when the service ends, unless the law requires storage. The processor must provide information demonstrating compliance and allow and contribute to audits. Check that the agreement describes how your business can obtain that information.<\/p>\n\n\n\n A sub-processor is another processor your supplier appoints to handle the data. Your processor needs your prior written authorisation before appointing a sub-processor. You can give specific or general written authorisation.<\/p>\n\n\n\n With general authorisation, the processor must tell you about proposed additions or replacements. You must have an opportunity to object. The processor must impose equivalent data protection obligations on the sub-processor.<\/p>\n\n\n\n Ask how the supplier sends change notices and who in your business will assess them. An unread notice can leave your team unaware of changes to the processing arrangements.<\/p>\n<\/div>\n\n\n\n You should review a supplier\u2019s standard terms against your planned processing. A familiar supplier name does not establish that the agreement meets your needs. Some suppliers will negotiate, while others offer little scope for changes.<\/p>\n\n\n\n You can discuss additional commercial protections alongside the mandatory terms. For example, an indemnity is a promise to cover specified losses. Check which losses the promise covers and how any contractual liability limit affects it.<\/p>\n\n\n\n When negotiating software subscription contracts<\/a>, consider how the data terms work with the wider agreement. Check the arrangements for recovering your data when you leave the service.<\/p>\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\nWhen Do You Need a Data Processing Agreement<\/h2>\n\n\n\n
What Your Agreement Must Cover<\/h3>\n\n\n\n
How to Control Further Outsourcing<\/h3>\n\n\n\n
Can You Negotiate a Supplier\u2019s Standard DPA<\/h3>\n\n\n\n