Data processor Definition

Case studies

"We have to become more agile as our clients' expectations and requirements change. The only thing we know is that tomorrow is going to be different and we must be prepared. With ��ɫ��, I feel more confident of that we're ready every time."

Wolverhampton County Council

Access all documents on Data processor

GET ACCESS NOW

GLOSSARY

Published by a ��ɫ�� Commercial expert

What does Data processor mean?

A data processor is a person who processes personal data for a data controller, other than the controller's employee. Outsourced IT and HR service providers may be processors.

Speed up all aspects of your legal work with tools that help you to work faster and smarter. Win cases, close deals and grow your business–all whilst saving time and reducing risk.

Data protection and trustees—checklist

Data protection and trustees—checklist This Checklist is designed to assist trustees to review and amend their working practices in relation to the personal information they collect, process and continue to hold about settlors, protectors, beneficiaries and other individuals connected to the trust. For a comprehensive introduction to Retained Regulation (EU) 2016/679, the UK General Data Protection Regulation (UK GDPR), collating key practical guidance, see: UK data protection law collection.Assimilated law is the name given to retained EU law (‘REUL’) which remains in force after the end of 2023. The re-categorisation of REUL (and associated terms) to assimilated law reflects a change in its status and treatment under UK law, in that it is generally to be interpreted according to ordinary domestic law and principles. From 1 January 2024, REUL is ‘assimilated’ into domestic law by virtue of the fact it is generally stripped of EU-derived interpretive effects (eg supremacy of EU law, directly effective rights, and general principles previously retained under EU(W)A 2018). Understand duties and obligations under the UK...

Reviewing terms for the purchase of goods or services as a buyer—business to business—checklist

Reviewing terms for the purchase of goods or services as a buyer—business to business—checklist This Checklist sets out the key considerations when reviewing contracts or terms and conditions for the purchase of goods or services between two businesses (ie a B2B contract). It can be used for reviewing standard terms of supply of goods or services and for bespoke supply agreements. It is drafted from a buyer, or the customer/purchaser, perspective. For general guidance on the purchase or supply of goods and services, see: Sale and supply of goods—overview and Supply of services—overview. Reviewing terms for the purchase of goods or services as a buyer—business to business Issue Description Further information Tick Preliminary considerations for a buyer of goods or services Recitals and representations Does the agreement include a preamble which sets out the buyer’s high level objectives and any seller representations in relation to its ability to provide the goods and services? Precedent: Background clausePractice Note: Misrepresentations—excluding and limiting liability for them ☐ Existing restrictions and permissions Have...

Discover our 6 Checklists on Data processor

Key definitions under the DPA 1998 [Archived]

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). This Practice Note is for background information only and is not maintained.BackgroundThe DPA 1998 governs processing of personal data in the UK. It obliges processors of such data to comply with eight principles, and gives individuals a right to know what information is held about them. For further information on the principles, see Practice Note: Data protection principles under the DPA 1998.The Information Commissioner's Office (ICO) supervises and enforces the implementation of the DPA 1998. For more information, see Practice Notes: The Information Commissioner’s Office (ICO) and Sanctions and enforcement under the DPA 1998.Sections 1 and 2 of the DPA 1998 contain definitions for the key terms used throughout the act and within the Information Commissioner's codes of practice or other guidance. Key statutory definitions include:•Data•Personal data•Sensitive personal data•Data subject•Data controller•Data processor•Processing•Relevant filing systemChanges as a result of the General Data Protection...

Applicability and scope of the DPA 1998 [Archived]

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). This Practice Note is for background information only and is not maintained.This Practice Note concerns the applicability and territorial scope of the DPA 1998. When considering the applicability of the DPA 1998, look at the following:•the type of data being processed—the DPA 1998 applies only to the processing of personal data, other data (eg statistical or other data which does not relate to an identifiable individual) is not covered•where the data controller is established—the DPA 1998 applies only to data controllers who are established in the UK and who process personal data in the context of that establishment. This covers UK based data controllers who process data connected to a UK business even if technically the processing takes place overseas (eg using servers located in another country)•the equipment/location of processing—where a non-UK, non-EEA data controller processes personal data using equipment located in...

Discover our 30 Practice Notes on Data processor

EU GDPR—2021 standard contractual clauses (SCCs) for the transfer of personal data to third countries—module four—processor to controller—where the processor combines with personal data collected by it in the EEA

EU GDPR—2021 standard contractual clauses (SCCs) for the transfer of personal data to third countries—module four—processor to controller—where the processor combines with personal data collected by it in the EEA STANDARD CONTRACTUAL CLAUSES SECTION I Clause 1 Purpose and scope (a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (1) for the transfer of personal data to a third country. (b) The Parties: (i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and (ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex...

Statement—agreement with volunteer (short form)

Statement—agreement with volunteer (short form) [Organisation name]: [Volunteer agreement] [We appreciate your commitment to us and we will do our best to make your volunteer experience with us positive and rewarding. To make sure you have the best possible experience we have created this agreement which sets out our commitment to you and what we hope you can contribute.] Commitments to volunteers We will: • ensure you are valued part of [organisation name]; • be responsive to your requirements and do our best to help you develop your volunteering role with us; • be flexible in relation to your volunteering hours, recognising your need for holiday time and other commitments; • honour the time commitment you have agreed to give us and not expect more from you unless offered and agreed; • provide you with an induction explaining how we operate and how your volunteering role fits in and provide appropriate training; • provide support throughout your volunteer experience; • explain the appropriate standards we expect and encourage and...

Dive into our 10 Precedents related to Data processor

Following a proposed change in suppliers (for example, transferring to a new provider of outsourced services), is the data subject’s consent required when transferring personal data from one service provider to another?

Following a proposed change in suppliers (for example, transferring to a new provider of outsourced services), is the data subject’s consent required when transferring personal data from one service provider to another? Such a situation can arise, for example, in fulfilment, where supplies are made to a customer (the data subject if an individual) by the supplier on behalf of the purchaser of the supplier’s services. The chain is: purchaser–> supplier–> customer. It is inevitable that the supplier is going to keep, be given or generate a database of customer supply details. It is also the case that those details (email addresses, name and address, order history, financial credibility and so on) are going to constitute personal data within the meaning of the Data Protection Act 1998 (DPA 1998), see Q&A: What is 'personal data' for the purposes of the Data Protection Act 1998? What, from a data protection perspective, then, happens if the supplier is changed? Assuming that those data in question are not sensitive...

Is an expert witness a controller or processor of personal data under the General Data Protection Regulation?

Is an expert witness a controller or processor of personal data under the General Data Protection Regulation? The question of whether a person or entity is a data processor or data controller will depend on the circumstances of each individual case. The key will be whether the expert witness determines the purposes and means of the processing of personal data (see Practice Note: Key definitions under UK data protection law—Controller). The Information Commissioner’s Office (ICO) has published guidance on controllers and processors under the General Data Protection Regulation (GDPR). It explains that: • if you exercise overall control of the purpose and means of the processing of personal data, ie you decide what data to process and why—you are a controller • if you don’t have any purpose of your own for processing the data and you only act on a client’s instructions, you are likely to be a processor—even if you make some technical decisions about how you process the data The ICO has also...

See the 27 Q&As about Data processor

Reforms to UK Data Protection Regime published

Information Law analysis: The UK government has now introduced the Data Protection and Digital Information Bill (the Bill). This analysis provides insight into some of the more significant data protection aspects of the proposed reforms. Written by André Bywater of Cordery in London whose focus is on compliance issues.

Question of the week: Is a law firm a data controller or data processor under the UK General Data Protection Regulation? If a law firm acts as data processor, what contractual terms are required?

This week’s question of the week is: Is a law firm a data controller or data processor under the UK General Data Protection Regulation? If a law firm acts as data processor, what contractual terms are required? Read our Q&A to learn more about this topic and what issues law firms may face.

Read the latest 16 News articles on Data processor

Top

Trial

��ɫ��

GLOSSARY