Data protection and third-party suppliers
There are many situations where the University might engage a third party to carry out activities on their behalf, perhaps some specialist expertise or a software platform.
Data processors and data controllers
Where the third party will be collecting or storing the personal data of our staff, students, or customers on our behalf they are acting as 鈥榙ata processors.鈥� The University is the 鈥榙ata controller鈥� and determining how the data is used; the supplier or 鈥榙ata processor鈥� is carrying out our instructions. If the data processor is using its own processors, such as a hosting provider, these are called 鈥榮ubprocessors.鈥�
In data protection law both 鈥榗ontrollers鈥� and 鈥榩rocessors鈥� have obligations under data protection law. If a processor suffers a data breach, the University could be liable for substantial monetary penalties.
Contract with the supplier
Whenever the University as 鈥榗ontroller鈥� uses a processor it needs to ensure that there is a formal written contract in place with the supplier. The contract needs to cover a range of standard provisions stating that the processor must:
- process data only on instructions from the University
- ensure that their staff accessing the data are under an obligation of confidentiality
- have appropriate security measures in place
- assist the University with any data protection impact assessments for the University in relation to the system
- only appoint their own third parties (鈥渟ubprocessors鈥�) on the University鈥檚 authorisation, who will process data at the same level of protection as they will
- demonstrate their compliance to the controller
- take appropriate measures to help the controller respond to requests from individuals to exercise their rights
- assist the controller in meeting its UK GDPR obligations in relation to the security of processing and the notification of data breaches
- delete or return all personal data to the controller at the end of the contract, and also delete existing personal data unless the law requires its storage
- submit to audits and inspections, providing the controller with whatever information it needs to ensure they are both meeting their Article 28 obligations
You can assess this in the contract checker document (.docx).
