As a UK supplier processing customer data, your ability to win contracts increasingly depends on demonstrating UK GDPR compliance. Customers now conduct thorough due diligence on data protection practices before engaging suppliers. This isn't just a legal requirement—it's crucial for building trust and maintaining your reputation.
Being well-prepared for customer due diligence can make you a more attractive supplier. It shows you can handle personal data responsibly, which is key in today's market.
Our data protection legal experts offer practical advice to help you respond effectively to data protection due diligence requests, ensuring you're ready to showcase your compliance and secure new business opportunities.
We'll cover the following:
Why is data protection due diligence important for your business?
It’s important to understand why due diligence requests land on your desk in the first place. Under GDPR, data controllers must only work with processors that provide sufficient guarantees of compliance with data protection rules. This means that before a contract can be signed with your business as a processor, controllers must assess whether your business has the appropriate technical and organisational measures in place to protect personal data they share with you (e.g. the data of their staff or clients which you’ll access when delivering your services).
If you’re not prepared or don’t have the answers, the due diligence process can delay projects and, in the worst case, can cause you to lose business if the customer isn’t comfortable about how you’ll safeguard their data.
What can your business do to prepare for due diligence?
No one can predict exactly what your controller customers will ask during due diligence. Their questions might depend on the nature of their business, the types of personal data you handle, and the level of risk involved. Here are some key steps your business can take to prepare:
Understand your data processing activities
A key step in preparing for due diligence is to fully understand how and why your business processes personal data on behalf of your customers.
Controllers will expect you to clearly explain how their personal data is used, stored, accessed, and why it is necessary under your contract. As part of this process, think about the purposes for which you need the data, which types of data you need to use, why, and how the data will flow, including any third parties who will have access to the data and whether it will be transferred outside of the UK.
You could explain this by creating a data flow diagram or data map, illustrating how you will use the controller’s data for their project. This should include every stage of processing, from collection to storage, transmission, and ultimate deletion of the controller’s data. Having a detailed and up-to-date data map ready to share with controllers will demonstrate that you have a thorough understanding of their data and are handling it responsibly.
It can also help answer a lot of questions from the outset about the types of data you use and why, which can avoid protracted back and forth. However, this might vary for different customers, so you should make sure you pay attention and tailor your approach and the information you present. If your customer has a Data Protection Officer, they may want to have a thorough understanding of your data processing from the get-go, to ensure their business needs to run a data protection impact assessment (a ‘DPIA’) before sharing information with you.
Review your data security measures
Data security is often one of the first concerns controllers will raise during due diligence.
Under the UK GDPR, as a data processor, you must implement strong security measures to protect personal data from unauthorised access, loss, and other risks. You need to have these safeguards in place and be prepared to explain them to your data controllers. For example, you may wish to consider the following measures to protect personal data you process on behalf of your customers:
- Ensure you have formal security processes and measures in place, which may cover encryption, access control, password protocols and other safeguards to protect data.
- If your employees work remotely, controllers will want to know how you secure personal data outside the office, so clear protocols for secure connections and equivalent standards to office-based security are essential.
- Regular testing and evaluation of your security measures, through penetration tests or security audits, is also critical. Controllers may expect to see evidence that these tests are conducted regularly, with results documented.
- Certifications such as ISO 27001 can help your businesses with GDPR compliance and can also demonstrate your commitment to maintaining high data security standards and instil confidence.
Demonstrate your compliance with evidence
To prepare for due diligence as a processor under UK GDPR, it’s essential to have clear evidence of your compliance with data protection requirements. You can demonstrate this by maintaining comprehensive records of your processing activities, which detail how you handle personal data on behalf of your customers. Additionally, keeping up-to-date staff training records shows that your employees are informed about their data protection responsibilities.
Having a well-documented data protection policy in place is also key. These records and policies can provide tangible evidence of your commitment to compliance, allowing you to confidently confirm to your customers that you have the necessary records, safeguards and processes in place to meet their data protection expectations. For instance, you can let your clients know you maintain these internal records and policies to protect personal data. If your customers request particular records this can raise issues (as they are likely to be company confidential or contain sensitive information or data about third parties), so you should seek legal advice before doing so.
Prioritise robust data processing agreements
A Data Processing Agreement (DPA) is a critical and mandatory document that defines the terms of data processing between your business and the controller. Under Article 28 of the UK GDPR, controllers are required to have these agreements in place before engaging you as a processor.
To prepare, make sure your DPAs are UK GDPR compliant and reflect your current processing activities. The DPA should also include details of the technical and organisational safeguards you have in place, such as encryption and breach detection procedures. If your business uses sub-processors, you will need to ensure that your DPA covers the use of these third parties and be prepared to answer questions about them. Alternatively, you can include data processing clauses in your services agreements with customers.
Controllers may review your DPA alongside running their due diligence, so preparing in advance will help your business streamline the process and demonstrate your commitment to compliance. If you have no DPA in place to present to controllers, this could raise red flags.
Anticipate and be ready for due diligence questions
During the due diligence process, controllers may ask a range of specific questions to assess your compliance with UK GDPR. Preparing responses in advance can help you respond confidently and avoid delays. You should also think about who is best placed to answer questions, and whether you need to involve your legal team (e.g. when a customer raises complex questions which you’re unsure about).
To prepare, think about things like:
- The security measures you have in place to protect personal data.
- How your business reports personal data breaches to controllers, including detection, response, and notification timeframes.
It can be beneficial for data processors to engage with customers early in the process to understand their specific concerns. Offering pre-prepared materials, such as detailed Q&A documents and data flow maps, can simplify the due diligence process for both sides. This proactive approach can also avoid last-minute pressure and build customer trust by showcasing preparedness. It can also save your business time and cost, particularly when you receive several due diligence questionnaires.
Benefits of being prepared for due diligence
Taking a proactive approach to preparing for customer due diligence can offer several key benefits. For example, you may be able to:
- Secure work faster by providing any necessary documentation and responses in a timely manner.
- Build trust with customers by demonstrating your commitment to data protection and compliance with UK GDPR.
- Save time and costs, as you’ll have all the necessary documentation ready to go, helping you avoid delays and streamline the due diligence process.
- Generally, improve your compliance by allowing you to focus on your key obligations as a processor and that they are in line with legal requirements.
Data protection questions can be complex, and the specific queries you receive may vary depending on your business model and how you handle personal data. Some questions that arise during due diligence can be particularly challenging, and a struggle when you are trying to get a new deal over the line. If so, legal advice from experienced data protection lawyers can be important in guiding you through the process and helping you get it right.
