Third-Party Data Processors and GDPR Audits: What You Need to Know

The General Data Protection Regulation (GDPR), which came into effect on 25 May 2018, is a key piece of legislation governing the protection of personal data for individuals within the European Union (EU). It reshaped the way organisations handle, store, and process personal data, placing individuals’ rights and data privacy at the forefront of its framework. The regulation introduced several new responsibilities for data controllers (entities that determine the purposes and means of processing personal data) and data processors (entities that process data on behalf of a controller), including strict requirements for the use of third-party data processors.

In today’s interconnected business landscape, it is common for organisations to outsource various services, such as IT support, cloud storage, marketing, and payroll, to third-party providers. While outsourcing is efficient, it also presents significant risks, particularly when personal data is involved. These risks are particularly relevant in the context of GDPR, which demands stringent compliance measures when engaging third-party data processors. The regulation places specific obligations on organisations, not only to ensure their own compliance but also to ensure that any third-party processors they engage adhere to the same standards of data protection.

This article delves into the key aspects of using third-party data processors under GDPR, the obligations of organisations in ensuring compliance, and what to expect during a GDPR audit. By the end, you will have a clear understanding of the importance of robust oversight when working with third-party processors and practical advice on how to remain compliant.

Table of Contents

Understanding Third-Party Data Processors

Under GDPR, a data processor is defined as any entity that processes personal data on behalf of a data controller. Processing, in this context, includes any operation or set of operations performed on personal data, such as collecting, recording, organising, storing, retrieving, using, disclosing, or erasing data.

When a controller engages a third-party processor, it does not transfer the responsibility for the data; instead, the controller remains liable for ensuring the processor adheres to the same data protection standards as required under GDPR. The involvement of third-party processors introduces several layers of complexity, as the data controller must maintain visibility and control over how personal data is processed, even though it is handled by an external entity.

Examples of Third-Party Data Processors

Cloud service providers: Offering storage or software-as-a-service (SaaS) solutions.
Marketing companies: Handling customer engagement, profiling, and data analytics.
Payroll service providers: Managing salary payments, benefits, and employee data.
IT support firms: Having access to an organisation’s IT infrastructure to provide technical assistance.

Each of these examples highlights a different facet of third-party data processing, demonstrating how integral these relationships have become in modern business. However, with increased reliance on external providers comes the heightened need for stringent controls and careful vetting to ensure GDPR compliance.

GDPR Requirements for Using Third-Party Processors

The GDPR mandates several obligations that organisations must fulfil when engaging third-party data processors. These requirements ensure that both the controller and the processor are aligned in terms of their responsibilities regarding data protection.

Data Processing Agreements (DPAs)

One of the most critical elements of GDPR compliance when using third-party processors is the requirement to establish a Data Processing Agreement (DPA). Article 28 of the GDPR outlines the need for a formal contract between the data controller and the data processor. The DPA should clearly define the scope of the data processing activities, including:

The subject matter of the processing.
The duration of the processing.
The nature and purpose of the processing.
The types of personal data processed.
The obligations and rights of both the controller and processor.

The DPA must also contain specific clauses that oblige the processor to:

Process personal data only on documented instructions from the controller.
Ensure that personnel authorised to process the data have committed to confidentiality.
Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
Assist the controller in ensuring compliance with GDPR obligations concerning data subjects’ rights, data breaches, and data protection impact assessments (DPIAs).
Engage sub-processors only with the prior written consent of the controller.
Delete or return all personal data to the controller at the end of the processing relationship.

Failure to include these elements in the DPA can result in non-compliance, which could lead to significant fines under GDPR.

Due Diligence and Ongoing Monitoring

Engaging a third-party data processor is not a “set-it-and-forget-it” activity. GDPR obliges data controllers to conduct due diligence before selecting a processor and maintain ongoing monitoring of the processor’s activities throughout the relationship.

Due diligence involves assessing the processor’s ability to comply with GDPR requirements, particularly with regard to security measures, breach response procedures, and experience in handling data subject rights requests. This assessment should be thorough and well-documented, as it may be subject to review in the event of a GDPR audit or investigation.

Once a third-party processor has been selected, the controller must ensure that the processor continues to comply with GDPR over time. This might involve regular audits, reviews of data protection policies, and checks on security certifications, such as ISO 27001.

Sub-Processors

Many third-party processors rely on sub-processors to deliver services. Under GDPR, the controller must have visibility and control over any sub-processors engaged by the primary processor. The processor is required to seek the controller’s prior written approval before engaging sub-processors, and the sub-processors must be bound by the same terms as those agreed upon in the DPA between the controller and the primary processor.

The use of sub-processors presents additional risks, as it introduces more parties into the data-processing chain. The controller must ensure that any sub-processors meet the same standards of GDPR compliance and that there are mechanisms in place to monitor their activities effectively.

Data Security Measures

Both data controllers and processors are required under GDPR to implement appropriate technical and organisational measures to protect personal data. The level of security should be commensurate with the risks involved in the processing activities. Some of the common security measures include:

Encryption: Ensuring that personal data is encrypted both in transit and at rest.
Access control: Restricting access to personal data to authorised personnel only.
Incident response plans: Establishing procedures for detecting, reporting, and responding to data breaches.
Regular audits: Conducting regular assessments of the security posture and compliance with GDPR.

It is important to note that the responsibility for data security lies with both the controller and the processor. Therefore, when engaging a third-party processor, the controller must ensure that the processor has implemented adequate security measures to safeguard the personal data being processed.

GDPR Audits: What to Expect

GDPR audits are designed to assess an organisation’s compliance with the regulation. These audits can be triggered for a variety of reasons, including complaints from data subjects, data breaches, or as part of routine oversight by a Data Protection Authority (DPA). In the context of third-party data processors, audits can scrutinise both the data controller and any external processors they use.

The Scope of a GDPR Audit

During a GDPR audit, the scope can vary depending on the specific concerns raised by the DPA. However, in the case of third-party processors, the audit will typically focus on:

The organisation’s relationships with third-party processors.
The existence and adequacy of Data Processing Agreements.
The due diligence conducted before engaging processors.
Security measures implemented by the processors.
The processes in place for monitoring and auditing third-party processors.

Auditors may request documentation such as DPAs, security certifications, audit reports, and records of due diligence. They may also interview personnel responsible for data protection, including both the controller and the processor.

Preparing for a GDPR Audit

To ensure that you are prepared for a GDPR audit, particularly with regard to third-party processors, it is essential to take a proactive approach to compliance. Key steps include:

Document everything: Ensure that you have comprehensive records of all data processing activities, including the due diligence performed when selecting third-party processors and the results of any audits or reviews.
Maintain up-to-date DPAs: Regularly review your Data Processing Agreements to ensure that they are still valid and reflect the current nature of the processing activities.
Monitor processor compliance: Implement a schedule for conducting regular audits of third-party processors and reviewing their security measures. Ensure that any sub-processors are also subject to the same level of scrutiny.
Test your data protection measures: Regularly test your own data protection and security measures to ensure that they are effective. This might include running mock audits or conducting penetration tests to identify potential vulnerabilities.

Consequences of Non-Compliance

Failure to comply with GDPR can result in significant penalties, particularly if a third-party processor is found to be non-compliant. Fines under GDPR can reach up to €20 million or 4% of an organisation’s global annual turnover, whichever is higher. In addition to financial penalties, non-compliance can lead to reputational damage, loss of business, and legal action from affected data subjects.

It is important to remember that even if the non-compliance originates from a third-party processor, the data controller remains ultimately responsible for ensuring that the processor adheres to GDPR. This makes it crucial for controllers to select processors with a strong track record of data protection and to monitor their compliance over time.

Conclusion: Navigating the Complexities of Third-Party Processing

The use of third-party data processors has become an essential part of modern business operations. However, under GDPR, it also introduces significant risks that must be carefully managed. Data controllers are required to maintain visibility and control over how personal data is processed by third parties, and they must ensure that processors meet the same high standards of data protection.

By implementing thorough due diligence processes, establishing robust Data Processing Agreements, and conducting ongoing monitoring, organisations can mitigate the risks associated with third-party data processors and remain compliant with GDPR. Proactive preparation for GDPR audits, particularly in terms of documenting processing activities and maintaining up-to-date contracts, will also help organisations avoid the severe consequences of non-compliance.

In an era where data breaches and privacy concerns are becoming increasingly prevalent, the importance of protecting personal data cannot be overstated. GDPR has set a high bar for data protection, and organisations must rise to the challenge, particularly when engaging third-party processors. By doing so, they not only ensure compliance but also foster trust and confidence among their customers and stakeholders.