Are Your Service Agreements GDPR Ready?

Even if you have outsourced the processing of personal data, you remain liable for that processing. You cannot outsource your statutory obligations, and failing to meet those obligations can carry heavy consequences.

The key issue is how the outsourcing company (in data protection parlance, the data controller) has instructed the service provider, i.e. the personal data processor. The instructions must be documented, and are often incorporated into data processing agreements that define the rights and obligations of both the data controller and the processor with respect to the processing of personal data.

A Data Processing Agreement is a Must

The GDPR requires that the outsourcing of personal data processing must be agreed in writing. The GDPR also sets minimum requirements for what the agreement must contain. The most important requirements are:

Many Kinds of Data Protection Agreements

In practice, a data protection agreement can be either included as a section on personal data processing in the service agreement itself or by executing a separate personal data processing appendix or agreement. A separate appendix is often a good option, because it is easy to add to existing agreements.

Despite the fact that the GDPR requires a written data processing agreement, neither the EU nor Finland’s data protection authorities have yet published model agreements. As a result, many data controllers and processors have drafted their own models in an effort to fulfil the requirements of the GDPR. As the roles of the companies, the personal data to be processed and the outsourced functions vary, data processing agreements also vary a great deal.

The GDPR sets the minimum requirements for data processing agreements, but it is often justified to agree on other things, as well. For example, the agreement can set out how quickly the data processor has to notify the data controller of data breaches.

In contract negotiations, the issue of the parties’ liability for damages and the possible limitation of liability often arises. It is worth dedicating time to resolving this, particularly when adding a data protection appendix to an existing service agreement. Other common issues that come up in negotiations include the processor’s right to use subcontractors, data transfers out of the EU, maintaining backups after the expiry of the service agreement and the compensation of costs incurred by the processor from assisting the data controller.

Choose Your Service Provider Carefully

Even though data processing agreements are important, data protection is something that needs to be on your mind already when choosing a service provider. Under the GDPR, the data controller must assess the expertise of service providers and only use providers that furnish sufficient guarantees that the data will be properly protected.

The higher the risk posed by processing to the data subjects – for instance, if the processing of healthcare data is being outsourced – the stronger the data controller’s obligation to ensure that the service provider is capable of processing personal data securely.

What is the Next Step?

The requirements of the GDPR are backed up by a significant risk of sanction. As a result, companies that are data controllers must first determine the circumstances in which they transfer personal data to service providers. Without this knowledge, it is difficult to ensure that the terms of any contracts they have meet the GDPR’s requirements. This is true of both existing and future contracting relationships

As the GDPR’s requirements are new, it is quite likely that existing service agreements do not meet all of them. Every company that has outsourced personal data processing needs to be preparing to amend their old agreements. There will only be few months’ transition time before the GDPR becomes effective, so if you haven’t already started updating your agreements, now is the time. Naturally, the GDPR’s requirements will have to be taken into account in new agreements, as well.