In today's data-driven business landscape, protecting personal information is paramount. Organisations must not only safeguard the data they hold but also ensure that any external entities with whom they share personal data adhere to stringent security measures.
The contractual terms used to safeguard the processing of personal data by third-party suppliers are commonly referred to as 'controller-to-processor' agreements or data processing agreements (DPAS). Well-drafted controller-to-processor contracts can not only help ensure compliance but also help foster a culture of trust between business partners.
In this article, we will explore what a controller-to-processor agreement is, when it is needed, and the key clauses it should contain. To discover what you should consider when negotiating controller-to-processor contracts, read our article here.
To ensure compliance with the UK GDPR, our expert data protection solicitors can provide tailored advice and assistance with drafting appropriate terms, based on your specific situation.
Contents:
- What is a controller-to-processor agreement?
- What is a data controller?
- What is a data processor?
- How do you determine each party's role under the UK GDPR?
- When do you need a controller-to-processor agreement?
- What structure should a controller-to-processor or data processing agreement take?
- What key clauses should a controller-to-processor agreement include?
- What additional issues should be considered for a controller-to-processor agreement?
- Further considerations
- Practical steps for controllers when entering a controller-to-processor agreement?
- Are there any additional considerations when entering into a data processing agreement?
- Summary
What is a controller-to-processor agreement?
Under the UK GDPR, if you handle personal information, you are acting either as a data controller or a data processor.
Often, data controllers share personal data with third-party data processors who act on their behalf, processing the personal data owned by the data controller. A controller-to-processor agreement is a contract entered into between a data controller and a data processor in these circumstances.
The definitions of data controller and data processor are crucial concepts under the UK GDPR rules. It is vital to distinguish between them because controllers have far more obligations under the UK GDPR than processors do.
What is a data controller?
A data controller is a natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data.
Essentially, a controller is a person or organisation that decides how and why to collect and use personal data and controls how personal data is used.
What is a data processor?
A data processor is a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
Essentially, a processor is a separate person or organisation that processes personal data on behalf of the controller and in accordance with their instructions.
Processors have fewer obligations than data controllers under UK data protection law.
Often, processors are third-party suppliers who deliver services to controller customers. However, this is not always the case, and each data-sharing role will need to be assessed on a case-by-case basis.
How do you determine each party's role under the UK GDPR?
Although the definitions of controller and processor may sound relatively straightforward, in practice, they can be challenging to determine.
Every time you share personal data, you should carefully consider the relevant personal data and the processing activities that will take place. You will need to determine which organisation is making decisions concerning the personal data being shared.
It may not be easy to determine who is the controller or processor, and this subject can cause confusion and lead to legal arguments, particularly when personal data is used for multiple purposes.
It may be that both parties are acting as controllers, for example, if both have an element of control over the personal data being shared. This would require a separate type of agreement, i.e., a data-sharing agreement between controllers.
The relationship between the parties and their roles in processing personal data will determine the type of legal agreement required for your data-sharing scenario.
To determine if a third party processes personal data on your behalf, you should consider questions including:
- What types of processing will the third party carry out?
- Who controls and has autonomy over how the data is processed?
You should seek legal advice if you are unsure about the type of agreement the parties should enter into when sharing personal data.
When do you need a controller-to-processor agreement?
Having understood the difference between a controller and a processor, you should move on to consider when a controller-to-processor agreement is required.
Under the UK GDPR rules, when a controller engages a processor, a controller-to-processor agreement is required.
You will need a controller-to-processor agreement:
- If you act as a controller and appoint a processor to process personal data on your behalf, or
- You are a processor processing personal data on behalf of a controller.
The following are practical examples of when a controller-to-processor agreement will usually be needed:
- Your business outsources its staff payroll services to an external payroll provider, who runs the monthly payroll for your company's staff. The payroll provider will use your staff's data solely to provide payroll services. They will have no control over your staff's data and will only process it according to your instructions. This means that the payroll provider will act as a processor on your behalf.
- Your business is an IT support company that provides support services to business customers. Your company processes the personal data of your customers' staff, including staff names, telephone numbers, and email addresses, to assist them with IT queries as needed. Your business does not decide what to do with the customer's staff data; instead, it processes it strictly in accordance with the customer's instructions. As such, your business acts as a processor on behalf of the controller, who is the customer.
In these circumstances, organisations would need to enter into a controller-to-processor agreement to comply with the rules under the UK GDPR.
What structure should a controller-to-processor or data processing agreement take?
If you have a controller-to-processor relationship, you will need to enter terms reflecting the UK GDPR Article 28 processor clauses.
Article 28 of the UK GDPR states that you must have a contract (or other legal act) containing specific clauses where there is a controller-to-processor arrangement. In practice, businesses usually sign an agreement to demonstrate compliance.
There are two common ways to implement this requirement:
- You can include the specific mandatory Article 28 clauses within your services agreement, or
- If your primary services agreement does not include the mandatory clauses, you will need a separate controller-to-processor agreement.
What key clauses should a controller-to-processor agreement include?
Article 28 of the UK GDPR outlines the mandatory clauses that controller-to-processor agreements must contain. These clauses are vital to ensure that the processing of personal data is compliant with the UK GDPR rules.
A processor must agree to various obligations, including:
- A processor must only process personal data in accordance with the documented instructions of the controller and notify the controller if it needs to process the personal data outside the scope of those instructions due to a legal requirement.
- A processor must ensure that individuals authorised to process personal data have committed themselves to confidentiality.
- A processor must take measures to comply with the UK GDPR security requirements, including implementing technical and organisational measures to ensure a level of security appropriate to the risk.
- A processor must not subcontract to another processor without the controller's consent and must then flow down its obligations to any sub-processors in a sub-processing agreement. Sub-processors are third-party data processors that the processor engages. It is now increasingly common for agreements to allow the processor general authority to appoint sub-processors, with the right for the controller to reject those third parties.
- A processor must assist the controller by supporting their obligations under the UK GDPR, including implementing data subject rights and conducting data protection impact assessments.
- A processor must return or delete all personal data upon the termination of services unless required by law.
- A processor must assist the controller in the event of a personal data breach.
- A processor must enable the controller to conduct an audit and provide the necessary information to demonstrate compliance with its obligations. The scope of these specific audit rights, including their scope, timing, and frequency, is often heavily negotiated.
- The written processing contract also needs to detail the processing activities, including:
-
- the subject matter and duration of the processing;
- the nature and purpose of the processing;
- the type of personal data, listing out which types of personal data are being exchanged between the parties (i.e., names, email addresses, etc.); and
- categories of data subjects, stating which individuals the personal data relates to, i.e., employees, clients.
Typically, these details are outlined in a table or appendix, which forms part of the agreement between the controller and the processor.
What additional issues should be considered for a controller-to-processor agreement?
Whilst the above are the mandatory clauses that the agreement should contain as a minimum, this is not all that parties need to consider as part of their agreement.
For example:
- The UK GDPR states that a controller should only use a processor which provides sufficient guarantees that it will implement appropriate technical and organisational measures. This is required to ensure that the processing meets the requirements of the UK GDPR and safeguards the rights of data subjects. Accordingly, data controllers must carry out thorough due diligence on intended suppliers whom they wish to engage, as these suppliers will have access to their controller's data.
- In addition, controller-to-processor agreements should also include provisions around the technical and organisational security measures of the relevant processor.
- Any pre-approved sub-processors that the controller has agreed to, for the processor to appoint, should also be set out in the agreement. If not, the contract should outline provisions regarding the process for appointing sub-processors, e.g., if the controller grants general authorisation with the right to object to new sub-processors.
- Further clauses, such as data protection indemnities, could be negotiated to allocate risk. See our separate article on commonly negotiated issues here.
- If personal data is to be transferred outside of the United Kingdom (for example, because the processor is located overseas), further additional considerations will apply. In such a case, the controller-to-processor agreement will need to document provisions regarding where the data will be transferred to and how the parties will comply with international data transfer laws. The parties may also need to enter into separate agreements, such as the UK International Data Transfer Agreement, as an appropriate safeguard. For more information, see our guide on transferring personal data from the UK.
Further considerations
It is essential to remember that entering into a controller-to-processor agreement is a shared responsibility between controllers and processors. Both controllers and processors should take this action seriously - failing to comply with these rules could result in severe consequences, such as a business being fined by the UK data protection regulator.
Either party could prepare the relevant controller-to-processor agreement of DPA, but do take note of the following when you are presented with a contract to sign:
- Carefully review the agreement to ensure it accurately reflects your data-sharing arrangements. For example, does it outline the processor's security measures, and does it specify the types of processing it will carry out on your behalf? A generic agreement is unlikely to be compliant.
- You will need to ensure your agreement is UK GDPR compliant and contains all the required mandatory clauses. If you are unsure about whether it is compliant, you should seek legal advice.
- Please note that your agreement may contain additional terms, such as commercial terms. However, they must not undermine the mandatory Article 28 UK terms explained above.
- Some large service providers will have their controller-to-processor agreements, which may be non-negotiable. However, you should carefully review those terms to ensure you are comfortable with them before proceeding.
Practical steps for controllers when entering a controller-to-processor agreement?
As a data controller, entering into controller-to-processor agreements may seem like a daunting exercise.
You should consider the following practical steps to help you work through the process:
- Identifying third parties with access to your company's data is a crucial first step.
- Make a list of all external third parties with whom you share personal data. This should include all suppliers, such as software, cloud storage, and CRM suppliers, as well as partners like distributors, resellers, agents, or anyone else who will process personal data you share with them.
- You should consider whether each of these parties will act as a data processor on your behalf.
- Conduct due diligence and research on the third parties with whom personal data will be shared, and assess the data security measures they have in place. This is a mandatory obligation for data protection law compliance and is particularly important because you will be liable for the actions of third parties with whom you share personal data.
- If you are satisfied with your due diligence and establish that a third party will act as a processor, you will then need to ensure there is a written controller-to-processor agreement in place with them.
- Check if third-party suppliers provide any existing agreements. For example, large processors such as Amazon and Mailchimp typically have standard data processing terms that you should carefully review. If you need advice on agreeing to third-party data processing terms, speak to an experienced data protection law solicitor.
- For any third parties that do not have their data processing terms, you will need to sign a controller-to-processor agreement, as discussed above.
Controller-to-processor agreements are not mere checkbox exercises; they should be approached with thorough attention and care to ensure compliance with relevant legal requirements and protection from risk.
Are there any additional considerations when entering into a data processing agreement?
You should note that a controller-to-processor agreement is not the only UK GDPR compliance action you will need to address when you are sharing personal data with a processor. Consider the following:
- Whether you have complied with the data protection law rules on data-sharing.
- Whether you have informed data subjects that you are sharing their data with third parties - for example, does your privacy policy list out all the third parties with whom personal data is shared? Our guide to creating a privacy policy for your company provides more detailed information. Remember that data subjects can query with whom their data will be shared, and you should be prepared to answer questions around this.
- Suppose the third-party processors are located outside the United Kingdom. In that case, you will need to consider the rules on international transfers of personal data. You may need to establish additional contractual documentation with them, depending on their location.
- You will also need to carry out due diligence on prospective third-party processors and document this to meet your accountability obligations under the UK GDPR.
- Who will cover the costs for specific actions, such as the processor assisting the controller with complying with its UK GDPR obligations? This is often heavily negotiated.
The above is a list of the key issues to consider. However, data-sharing with processors is a vast and high-risk topic.
Summary
In summary, a controller-to-processor agreement is a critical legal requirement under the UK GDPR rules and should not be ignored. If you would like advice on whether your business requires a controller-to-processor agreement, please contact our data protection solicitors who will be happy to assist you.
