In our digital world filled with data heavy businesses, how you safeguard personal data is crucial. Any external businesses with whom you share personal data should also treat that data with great care and take active steps to protect it.
The terms used to safeguard the processing of personal data by third party suppliers are commonly referred to as ‘controller to processor’ agreements. Well-drafted controller to processor agreements can not only help ensure compliance, but also help foster a culture of trust between business partners.
In this guide, we will explore what a controller to processor agreement is, when it is needed and the key clauses it should contain.
To ensure you comply with UK GDPR, our expert data protection solicitors can provide advice, tailored to your situation, and help with drafting or negotiating appropriate terms.
Contents:
- What is a controller to processor agreement?
- When do you need a controller to processor agreement?
- What structure should a controller to processor agreement take?
- What key clauses should a controller to processor agreement include?
- What additional issues should be considered for a controller to processor agreement?
- What else should we consider when entering into a controller to processor agreement?
- What practical steps should a controller take when entering a controller to processor agreement?
- Other considerations when entering into controller to processor agreements
- Summary
What is a controller to processor agreement?
Under the UK GDPR, if you handle personal information, you are acting either as a data ‘controller’ or a data ‘processor’.
Often, data controllers will share personal data with third party data processors who act on their behalf by processing the personal data owned the data controller. A controller to processor agreement is a contract entered into between a data controller and a data processor in these circumstances.
The definition of data controller and data processor are crucial concepts under the UK GDPR rules. It is vital to distinguish between them, because controllers have far more obligations under the UK GDPR than processors do.
What is a data controller?
A data controller is a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Essentially, a controller is the person or organisation that decides how and why to collect and use personal data and controls how personal data is used.
What is a data processor?
A data processor is a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
Essentially, a processor is a separate person or organisation who processes personal data on behalf of the controller and in accordance with their instructions.
Processors do not have as many obligations as data controllers under UK data protection law.
Often, processors are third party suppliers who deliver services to controller customers.
Determining each party’s role under the UK GDPR
Although these definitions may sound quite straightforward, in practice they can be difficult to determine.
On every occasion you are sharing personal data, you should carefully consider the relevant personal data and the processing activities taking place. You’ll need to determine which organisation is making decisions concerning the personal data being shared.
It might not be easy to establish who is the controller or processor and this subject causes confusion and legal arguments, particularly where personal data is used for multiple purposes.
It may be that both parties are each acting as controllers, for example if both have an element of control over the personal data being shared. This would require a separate type of agreement, i.e., a data sharing agreement between controllers.
The relationship between the parties and their roles in processing personal data will determine which type of legal agreement you need for your data sharing scenario.
To determine if a third-party processes personal data on your behalf, you should consider questions including:
- What types of processing will the third party carry out?
- Who controls and has autonomy over how the data is processed?
You should take legal advice if you are unsure about which type of agreement the parties should enter into when personal data is being shared.
When do you need a controller to processor agreement?
Having understood the difference between a controller and a processor, you should move on to consider when a controller to processor agreement is required.
Under the UK GDPR rules, when a controller engages a processor, a controller to processor agreement is required.
You will need a controller to processor agreement:
- if you act as a controller and appoint a processor to process personal data on your behalf; or
- you are a processor processing personal data on behalf of a controller.
The following are practical examples of when a controller to processor agreement will usually be needed:
- Your business outsources its staff payroll services to an external payroll provider, who runs the monthly payroll for your company’s staff. The payroll provider will use your staff personal data solely to provide payroll services. They will have no control over your staff personal data and only follow your instructions when processing it. This means the payroll provider will be a processor acting on your behalf.
- Your business is an IT support company providing support services to a business customer. Your company processes the personal data of staff of your customer (i.e. staff names, telephone numbers and email addresses) to help them with IT queries when required. Your business does not decide what to do with the customer’s staff data and again processes it on the strict instructions of the customer. As such, your business acts as a processor on behalf of the controller who is the customer.
In these circumstances, organisations would need to enter into a controller to processor agreement to comply with the rules under the UK GDPR.
What structure should a controller to processor agreement take?
If you have a controller to processor relationship, your contract will need to include the UK GDPR Article 28 processor clauses.
Article 28 of the UK GDPR states that you must have a contract (or other legal act) containing specific clauses where there is a controller to processor arrangement. In practice, businesses sign a contract to demonstrate compliance.
There are two common ways to implement this requirement:
- you can include the specific mandatory Article 28 clauses within your services agreement; or
- if your main services agreement does not include the mandatory clauses, you will need a separate data processing agreement (DPA).
What key clauses should a controller to processor agreement include?
Article 28 of the UK GDPR sets out the mandatory clauses which controller to processor agreements should contain. These clauses are vital, to ensure that the processing of personal data is compliant with the UK GDPR rules.
Under the agreement, a processor must agree to various obligations including the following:
- A processor must only process personal data by following the documented instructions of the controller and let the controller know if the processor needs to process the personal data outside of the scope of those instructions, due to a legal requirement.
- A processor must inform the controller immediately if they think any of the controller’s instructions infringe the UK GDPR rules.
- A processor must ensure that individuals authorised to process personal data have committed themselves to confidentiality.
- A processor must take measures to comply with the UK GDPR security requirements, including implementing technical and organisational measures to ensure a level of security appropriate to the risk.
- A processor must not subcontract to another processor without the controller’s consent, and must then flow down its obligation to any sub-processors in a sub-processing agreement. Sub-processors are third party data processors, engaged by the processor.
- A processor must assist the controller by supporting their obligations under the UK GDPR, including in giving effect to data subject rights and with data protection impact assessments.
- A processor must return or delete all personal data upon the termination of services, unless required by law.
- A processor must assist the controller in the event of a personal data breach.
- A processor must allow the controller to conduct an audit and provide information necessary to demonstrate compliance with its obligations.
The written processing contract also needs to expressly detail the processing activities, including:
- the subject-matter and duration of the processing;
- the nature and purpose of the processing;
- the type of personal data, listing out which types of personal data are being exchanged between the parties (i.e. names, email addresses etc.); and
- categories of data subjects, stating which individuals the personal data relates (to i.e. employees, clients).
Usually, these details would be set out in a table which forms part of the agreement between the controller and the processor.
What additional issues should be considered for a controller to processor agreement?
Whilst the above are the mandatory clauses which the agreement should contain as a minimum, this is not all that parties need to think about as part of their agreement.
For example:
- The UK GDPR states that a controller should only use a processor which provides sufficient guarantees that it will implement appropriate technical and organisational measures. This is required so that the processing will meet the requirements of the UK GDPR and safeguard data subject rights. Accordingly, data controllers must carry out thorough due diligence on intended suppliers whom they wish to engage, where they will have access to their controller’s personal data.
In addition, controller to processor agreements should also include provisions around the technical and organisational security measures of the relevant processor. - Any approved sub-processors whom the controller has agreed to the processor appointing should also be set out in the agreement.
- The controller may request that the processor compensates their business for losses suffered because of the processor’s breach of the data processing agreement. It is common for controllers to request indemnities from processors, requiring them to reimburse the controllers for any losses and financial penalties they suffer as a result of processors breaching the UK GDPR rules. This is often a heavily negotiated, yet vital, part of a controller to processor agreement. For more insight and tips please see our article on negotiating data processing agreements.
- If personal data is to be transferred outside of the United Kingdom (for example, because the processor is located overseas), further additional considerations will apply. In such case, the controller to processor agreement will need to document provisions around where the data will be transferred to and how the parties will comply with international data transfer law rules. The parties may also need to enter into separate agreements, such as the UK International Data Transfer Agreement, as an appropriate safeguard. See our guide on transferring personal data from the UK for more information. Please note, this is a fast moving and complicated topic, and you should seek legal advice if you are unsure about how to comply with international data transfer law requirements.
What else should we consider when entering into a controller to processor agreement?
You should remember that entering into a data processing agreement is the responsibility of both controllers and processors. Both controllers and processors should take this action seriously – failing to comply with these rules could result in severe consequences, such as your business being fined by the UK data protection regulator.
Either party could prepare the relevant controller to processor agreement.
You should note as follows when you are presented with an agreement to sign:
- You should also carefully review the agreement to make sure it is accurate in reflecting your data sharing arrangements. For example, does it contain the processor’s security measures and does it correctly set out details of what types of processing they will carry out on your behalf? A generic agreement is unlikely to be compliant.
- You will need to ensure your controller to processor agreement is UK GDPR compliant and contains all the required mandatory clauses. If you are unsure about whether it is compliant, you should seek legal advice.
- Some large service providers will have their own controller to processor agreements, which may be non-negotiable. However, you should carefully review those terms to ensure you are comfortable with them before proceeding.
- As part of your review of a controller to processor agreement, you may wish to negotiate certain terms to protect your business. For example, an indemnity clause. A data protection solicitor can advise and assist you with this and help guide you on what risks to consider as part of this process, depending on the nature of your project and the risks to individuals whose personal data will be processed.
What practical steps should a controller take when entering a controller to processor agreement?
As a data controller, entering into these agreements may seem like a daunting exercise.
You should consider the following practical steps to help you work through the process:
- Identifying third parties who have access to your company’s personal data is a crucial first step.
Make a list of all external third parties with whom you will share personal data. This should include all suppliers (such as software, cloud storage and CRM suppliers, partners such as distributors, resellers, agents, or anyone else will process personal data you share with them).
You should consider whether each of these parties will act as a data processor on your behalf. - Carry out research on the third parties with whom personal data will be shared and consider what data security measures they have in place. This is a mandatory obligation for data protection law compliance and is particularly important because you will be liable for the actions of third parties whom you share personal data with.
- If you are satisfied with your due diligence and establish that a third party will act as a processor, you will then need to ensure there is a written controller to processor agreement in place with them.
Check if there are already any existing agreements provided by the third-party suppliers - for example, large processors such as Amazon and Mailchimp will have their own standard data processing terms which you should carefully review.
If you need advice on agreeing to third party data processing terms, you should speak to an experienced data protection law solicitor.
Unfortunately, it may be difficult to negotiate terms with large providers, however a solicitor can guide you on this. If you feel the terms of the third-party supplier are too risky and cannot be negotiated, you may wish to consider mitigating those risks (for example, by sharing less sensitive data with them) or working with a different supplier. - For any third parties who do not have their own data processing terms, you will need to sign a controller to processor agreement as discussed above.
- Controller to processor agreements are not checkbox exercises – they should be approached with thorough attention and care, to ensure they comply with the relevant legal requirements and protect you from risk.
Other considerations when entering into controller to processor agreements
You should note that a data sharing agreement is not the only UK GDPR compliance action you will need to address when you are sharing personal data with a processor.
For example, you will need to consider other issues including:
- Whether you have complied with the data protection law rules on data sharing.
- Whether you have informed data subjects you are sharing their personal data with third parties – for example, does your Privacy Policy list out all the third parties with whom personal data is shared? Our guide to creating a privacy policy for your company explains this in more detail.
Remember that data subjects can query whom their personal data will be shared with, and you should be prepared to answer questions around this. - If the third-party processors are located outside of the United Kingdom, you will need to consider the rules on international transfers of personal data and may need to put additional contractual documentation in place with them (depending on where they are located).
- You will also need to carry out due diligence on prospective third-party processors and document this, to meet your accountability obligations under the UK GDPR.
The above is a list of the key issues to consider. However, data sharing is a vast and high-risk topic. Please contact our team if you require comprehensive advice on all requirements applicable to your busines when sharing personal data.
Summary
In summary, a controller to processor agreement is a critical legal requirement under the UK GDPR rules and should not be ignored.
Agreeing to data processing terms is not always a simple exercise. For example, you will need to consider issues around liability and indemnities, sub-processors chains and carry out due diligence to check how your data will be secured.
Negotiating the terms of a controller to processor agreement will depend on various factors including the bargaining power of the parties and the risk and value of the relevant project. Your terms will also need to be carefully tailored, to cover the specific data processing which the processor will carry out on your behalf.
If you would like advice on whether your business needs a controller to processor agreement, or help with drafting or negotiating one, please contact our data protection law team who will be happy to support you.
