GDPR Q45
How do I handle third-party data processors?
Q45. How do I handle third-party data processors?
Category: Third Parties
Third-party processors handle data on your behalf. You remain responsible for ensuring they meet GDPR standards.
In simple terms
- Carry out due diligence before appointing a processor.
- Set expectations through contracts and monitoring.
- Manage onboarding, oversight, and offboarding carefully.
Selecting processors
Assess experience, security practices, certifications, and incident history. Ask for references and independent audit reports.
- Check where data will be stored and processed.
- Confirm the processor can help with rights requests and breaches.
- Ensure they understand your industry’s specific obligations.
Ongoing oversight
Monitor performance, review reports, and conduct audits. Maintain communication channels for incidents and changes.
- Use KPIs or service levels that include data protection metrics.
- Require notification before engaging subprocessors.
- Update contracts if services or risks change.
Practical steps to take
- Run due diligence questionnaires covering security, governance, and certifications.
- Sign compliant DPAs before any data sharing.
- Maintain a processor register with contacts and contract details.
- Schedule regular reviews or audits of critical processors.
- Plan exit strategies, including data return or deletion.
Real-life examples
Cloud payroll
A company reviews the provider’s ISO certificates annually and receives quarterly security reports.
Marketing agency
The controller limits data access, requires breach notification within 24 hours, and conducts yearly audits.
Helpful reminders
- Processors must not use your data for their own purposes.
- Keep clear records of processor approvals and reviews.
- Escalate issues quickly and consider alternative suppliers if standards slip.
Key takeaway
Choose processors carefully and monitor them closely—your compliance depends on their actions too.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.