In today's data-driven business landscape, the protection of personal information is paramount. Organisations must not only safeguard the data they hold but also ensure that any external entities with whom they share personal data adhere to stringent security measures.
The contractual terms used to safeguard the processing of personal data by third-party suppliers are commonly referred to as 'controller-to-processor' agreements. Well-drafted controller-to-processor agreements can not only help ensure compliance but also help foster a culture of trust between business partners.
In this article, we will explore what a controller-to-processor agreement is when it is needed, and the key clauses it should contain. To discover what you should consider when negotiating controller-to-processor agreements, read our article here.
To ensure you comply with UK GDPR, our expert data protection solicitors can provide advice, tailored to your situation, and help with drafting appropriate terms.
Contents:
- What is a controller-to-processor agreement?
- What is a data controller?
- What is a data processor?
- How do you determine each party's role under the UK GDPR?
- When do you need a controller-to-processor agreement?
- What structure should a controller-to-processor agreement take?
- What key clauses should a controller-to-processor agreement include?
- What additional issues should be considered for a controller-to-processor agreement?
- Further considerations
- Practical steps for controllers when entering a controller-to-processor agreement?
- Are there any additional considerations when entering into controller-to-processor agreements?
- Summary
What is a controller-to-processor agreement?
Under the UK GDPR, if you handle personal information, you are acting either as a data 'controller' or a data 'processor'.
Often, data controllers will share personal data with third-party data processors who act on their behalf by processing the personal data owned by the data controller. A controller-to-processor agreement is a contract entered into between a data controller and a data processor in these circumstances.
The definition of data controller and data processor are crucial concepts under the UK GDPR rules. It is vital to distinguish between them because controllers have far more obligations under the UK GDPR than processors do.
What is a data controller?
A data controller is a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Essentially, a controller is a person or organisation that decides how and why to collect and use personal data and controls how personal data is used.
What is a data processor?
A data processor is a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
Essentially, a processor is a separate person or organisation that processes personal data on behalf of the controller and in accordance with their instructions.
Processors do not have as many obligations as data controllers under UK data protection law.
Often, processors are third-party suppliers who deliver services to controller customers. However, this is not always the case, and each data-sharing role will need to be assessed on a case-by-case basis.
How do you determine each party's role under the UK GDPR?
Although the controller and processor definitions may sound quite straightforward, in practice they can be difficult to determine.
Every time you are sharing personal data, you should carefully consider the relevant personal data and the processing activities taking place. You will need to determine which organisation is making decisions concerning the personal data being shared.
It might not be easy to establish who is the controller or processor and this subject can cause confusion and legal arguments, particularly where personal data is used for multiple purposes.
It may be that both parties are each acting as controllers, for example, if both have an element of control over the personal data being shared. This would require a separate type of agreement, i.e., a data-sharing agreement between controllers.
The relationship between the parties and their roles in processing personal data will determine which type of legal agreement you need for your data-sharing scenario.
To determine if a third party processes personal data on your behalf, you should consider questions including:
- What types of processing will the third party carry out?
- Who controls and has autonomy over how the data is processed?
You should take legal advice if you are unsure about which type of agreement the parties should enter when personal data is being shared.
When do you need a controller-to-processor agreement?
Having understood the difference between a controller and a processor, you should move on to consider when a controller-to-processor agreement is required.
Under the UK GDPR rules, when a controller engages a processor, a controller-to-processor agreement is required.
You will need a controller-to-processor agreement:
- If you act as a controller and appoint a processor to process personal data on your behalf; or
- You are a processor processing personal data on behalf of a controller.
The following are practical examples of when a controller-to-processor agreement will usually be needed:
- Your business outsources its staff payroll services to an external payroll provider, who runs the monthly payroll for your company's staff. The payroll provider will use your staff personal data solely to provide payroll services. They will have no control over your staff personal data and only follow your instructions when processing it. This means the payroll provider will be a processor acting on your behalf.
- Your business is an IT support company providing support services to a business customer. Your company processes the personal data of staff of your customer (i.e., staff names, telephone numbers and email addresses) to help them with IT queries when required. Your business does not decide what to do with the customer's staff data and again processes it on the strict instructions of the customer. As such, your business acts as a processor on behalf of the controller who is the customer.
In these circumstances, organisations would need to enter into a controller-to-processor agreement to comply with the rules under the UK GDPR.
What structure should a controller-to-processor agreement take?
If you have a controller-to-processor relationship, you will need to enter terms reflecting the UK GDPR Article 28 processor clauses.
Article 28 of the UK GDPR states that you must have a contract (or other legal act) containing specific clauses where there is a controller-to-processor arrangement. In practice, businesses usually sign a contract to demonstrate compliance.
There are two common ways to implement this requirement:
- You can include the specific mandatory Article 28 clauses within your services agreement; or
- If your main services agreement does not include the mandatory clauses, you will need a separate controller-to-processor agreement.
What key clauses should a controller-to-processor agreement include?
Article 28 of the UK GDPR sets out the mandatory clauses which controller-to-processor agreements should contain. These clauses are vital, to ensure that the processing of personal data is compliant with the UK GDPR rules.
A processor must agree to various obligations including the following:
- A processor must only process personal data by following the documented instructions of the controller and let the controller know if the processor needs to process the personal data outside of the scope of those instructions, due to a legal requirement.
- A processor must ensure that individuals authorised to process personal data have committed themselves to confidentiality.
- A processor must take measures to comply with the UK GDPR security requirements, including implementing technical and organisational measures to ensure a level of security appropriate to the risk.
- A processor must not subcontract to another processor without the controller's consent and must then flow down its obligation to any sub-processors in a sub-processing agreement. Sub-processors are third-party data processors, engaged by the processor. It is now increasingly common for agreements to allow the processor general authority to appoint sub-processors, with the right for the controller to reject those third parties.
- A processor must assist the controller by supporting their obligations under the UK GDPR, including in giving effect to data subject rights and with data protection impact assessments.
- A processor must return or delete all personal data upon the termination of services unless required by law.
- A processor must assist the controller in the event of a personal data breach.
- A processor must allow the controller to conduct an audit and provide information necessary to demonstrate compliance with its obligations. The scope of these specific audit rights, including their scope, timing, and frequency, are often heavily negotiated.
- The written processing contract also needs to expressly detail the processing activities, including:
- the subject matter and duration of the processing;
- the nature and purpose of the processing;
- the type of personal data, listing out which types of personal data are being exchanged between the parties (i.e., names, email addresses etc.); and
- categories of data subjects, stating which individuals the personal data relates (to i.e., employees, clients).
Usually, these details would be set out in a table or appendix which forms part of the agreement between the controller and the processor.
What additional issues should be considered for a controller-to-processor agreement?
Whilst the above are the mandatory clauses which the agreement should contain as a minimum, this is not all that parties need to think about as part of their agreement.
For example:
- The UK GDPR states that a controller should only use a processor which provides sufficient guarantees that it will implement appropriate technical and organisational measures. This is required so that the processing will meet the requirements of the UK GDPR and safeguard data subject rights. Accordingly, data controllers must carry out thorough due diligence on intended suppliers whom they wish to engage, where they will have access to their controller's personal data.
- In addition, controller-to-processor agreements should also include provisions around the technical and organisational security measures of the relevant processor.
- Any pre-approved sub-processors whom the controller has agreed to the processor appointing should also be set out in the agreement. If not, the agreement should set out provision around the process for appointing sub-processors, e.g., if the controller grants general authorisation with the right to object to new sub-processors.
- Further clauses such as data protection indemnities could be negotiated to allocate risk. See our separate article on commonly negotiated issues here.
- If personal data is to be transferred outside of the United Kingdom (for example, because the processor is located overseas), further additional considerations will apply. In such case, the controller-to-processor agreement will need to document provisions around where the data will be transferred to and how the parties will comply with international data transfer law rules. The parties may also need to enter into separate agreements, such as the UK International Data Transfer Agreement, as an appropriate safeguard. See our guide on transferring personal data from the UK for more information.
Further considerations
You should remember that entering into a controller-to-processor agreement is the responsibility of both controllers and processors. Both controllers and processors should take this action seriously - failing to comply with these rules could result in severe consequences, such as a business being fined by the UK data protection regulator.
Either party could prepare the relevant controller-to-processor agreement.
You should note the following when you are presented with an agreement to sign:
- Carefully review the agreement to make sure it is accurate in reflecting your data-sharing arrangements. For example, does it contain the processor's security measures and does it correctly set out details of what types of processing they will carry out on your behalf? A generic agreement is unlikely to be compliant.
- You will need to ensure your agreement is UK GDPR compliant and contains all the required mandatory clauses. If you are unsure about whether it is compliant, you should seek legal advice.
- Note that your agreement can contain additional terms (such as commercial terms), however, they must not undermine the mandatory Article 28 UK terms explained above.
- Some large service providers will have their own controller-to-processor agreements, which may be non-negotiable. However, you should carefully review those terms to ensure you are comfortable with them before proceeding.
Practical steps for controllers when entering a controller-to-processor agreement?
As a data controller, entering into controller-to-processor agreements may seem like a daunting exercise.
You should consider the following practical steps to help you work through the process:
- Identifying third parties with access to your company's personal data is a crucial first step.
- Make a list of all external third parties with whom you share personal data. This should include all suppliers (such as software, cloud storage and CRM suppliers, partners such as distributors, resellers, agents, or anyone else who will process personal data you share with them).
- You should consider whether each of these parties will act as a data processor on your behalf.
- Carry out due diligence and research on the third parties with whom personal data will be shared and consider what data security measures they have in place. This is a mandatory obligation for data protection law compliance and is particularly important because you will be liable for the actions of third parties whom you share personal data with.
- If you are satisfied with your due diligence and establish that a third party will act as a processor, you will then need to ensure there is a written controller-to-processor agreement in place with them.
- Check if there are already any existing agreements provided by the third-party suppliers - for example, large processors such as Amazon and Mailchimp will have their own standard data processing terms which you should carefully review. If you need advice on agreeing to third-party data processing terms, speak to an experienced data protection law solicitor.
- For any third parties who do not have their own data processing terms, you will need to sign a controller-to-processor agreement as discussed above.
Controller-to-processor agreements are not checkbox exercises - they should be approached with thorough attention and care, to ensure they comply with the relevant legal requirements and protect you from risk.
Are there any additional considerations when entering into controller-to-processor agreements?
You should note that a controller-to-processor agreement is not the only UK GDPR compliance action you will need to address when you are sharing personal data with a processor.
For example, you will need to consider other issues including:
- Whether you have complied with the data protection law rules on data-sharing.
- Whether you have informed data subjects you are sharing their personal data with third parties - for example, does your privacy policy list out all the third parties with whom personal data is shared? Our guide to creating a privacy policy for your company explains this in more detail. Remember that data subjects can query whom their personal data will be shared with, and you should be prepared to answer questions around this.
- If the third-party processors are located outside of the United Kingdom, you will need to consider the rules on international transfers of personal data and may need to put additional contractual documentation in place with them (depending on where they are located).
- You will also need to carry out due diligence on prospective third-party processors and document this, to meet your accountability obligations under the UK GDPR.
- Who will pick up the costs for certain actions - for instance, the processor assisting the controller with complying with its UK GDPR obligations? This is often heavily negotiated.
The above is a list of the key issues to consider. However, data-sharing with processors is a vast and high-risk topic.
Summary
In summary, a controller-to-processor agreement is a critical legal requirement under the UK GDPR rules and should not be ignored. If you would like advice on whether your business needs a controller-to-processor agreement, please contact our data protection legal experts who will be happy to support you.
