Supply Chain Compliance with the GDPR

|
|
PUBLISHED on
22 Jul
2022

Table of Contents

This blog focuses on an aspect of the GDPR which can be particularly challenging for a number of organisations, namely, how do you ensure your supply chain complies with the Regulation when processing personal data?  The obligations for data controllers to manage the processing of personal data throughout their supply chain are clearly set out in Articles 28 and 29 of the GDPR, and there were similar obligations to obtain ‘written guarantees’ from suppliers and service providers in previous legislation.

If you are a data controller, you are required to protect the rights of individuals, including the secure processing of their data.  This obligation entails passing compliance measures down to any external organisations that process or access your data via contractual conditions.  Sounds straightforward, eh?  You just issue a contract change note or GDPR contract addendum to all your existing suppliers.  Unfortunately, it gets a bit trickier when it comes to new suppliers.  How do you assess whether the new supplier has sufficient security controls in place to protect your personal data to a level that is equal to, or greater than, your own?

The answer is to ensure that you have a data protection/GDPR specialist involved in the onboarding of any new suppliers.  Typically, this individual would be your data protection officer (DPO), who is responsible for assessing the controls a potential new supplier has in place to protect personal data and would ultimately have the power to veto any contract being signed.

We often find the supplier onboarding process misses some fundamental trigger questions, namely:

  • Will this supplier’s services require access to our personal data or our premises where we process personal data?
  • Will this supplier provide services that will host or operate systems that will hold or process our personal data?

If the answer to either question is yes, then you need to involve your DPO in the supplier assessment process.  As with any process, there are always a few ‘rabbit holes’ to look out for.  Here a few to consider:

  • In some organisations, departmental or functional heads have the ability to sign off services up to certain spend limits, without having to go through formal procurement or supplier engagement processes. And whilst there may not be a big spend involved, there could be a big risk in terms of non-compliance with the GDPR.
  • Staff policies often contain statements relating to the installation of software on company equipment, but no restrictions on acquiring ‘online’ services.  As such, before you know it, your personal data may end up being processed or accessible by an unknown third party offering a ‘free’ service.
  • Some supplier relationships are based on long-term business opinion or service experience, without a contract at all.  As we know, this can be dangerous ground with personnel and structural changes to the organisation, e.g., mergers, takeovers
  • Big and small technical departments alike often circumvent the process when under pressure to deliver new or upgraded technology.  The supplier management process must link into IT change management and IT project management to identify those seemingly innocent tools, plug-in apps and cloud ‘platform’ services.  All of these can have implications for protecting personal data and, ultimately, the responsibility lies with you!

Do you need assistance in improving your GDPR compliance position?

URM can offer a host of consultancy services to improve your DP policies, privacy notices, DPIAs, ROPAs, privacy notices, data retention schedules and training programmes etc.
Thumbnail of the Blog Illustration
Data Protection
Published on
27/11/2023
Clearview Case

URM details Clearview AI’s successful appeal against the ICO imposing a £7.5 million fine for breach of the UK GDPR and their grounds for reversing the ruling.

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
10/6/2022
How to Create a Record of Processing Activities (ROPA)

In this blog, we will outline a step-by-step procedure on how you can create a ROPA.

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
25/7/2022
In-house Resource vs Virtual DPO

This blog takes a look at DPOs and considers when to look in-house and when a virtual, external resource or hybrid resource may be a better option.

Read more
Informative webinar. Thank you!
Webinar 'GDPR - Back to Basics'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.