Supply Chain Compliance with the GDPR

|
|
PUBLISHED on
22 Jul
2022

Table of Contents

This blog focuses on an aspect of the GDPR which can be particularly challenging for a number of organisations, namely, how do you ensure your supply chain complies with the Regulation when processing personal data?  The obligations for data controllers to manage the processing of personal data throughout their supply chain are clearly set out in Articles 28 and 29 of the GDPR, and there were similar obligations to obtain ‘written guarantees’ from suppliers and service providers in previous legislation.

If you are a data controller, you are required to protect the rights of individuals, including the secure processing of their data.  This obligation entails passing compliance measures down to any external organisations that process or access your data via contractual conditions.  Sounds straightforward, eh?  You just issue a contract change note or GDPR contract addendum to all your existing suppliers.  Unfortunately, it gets a bit trickier when it comes to new suppliers.  How do you assess whether the new supplier has sufficient security controls in place to protect your personal data to a level that is equal to, or greater than, your own?

The answer is to ensure that you have a data protection/GDPR specialist involved in the onboarding of any new suppliers.  Typically, this individual would be your data protection officer (DPO), who is responsible for assessing the controls a potential new supplier has in place to protect personal data and would ultimately have the power to veto any contract being signed.

We often find the supplier onboarding process misses some fundamental trigger questions, namely:

  • Will this supplier’s services require access to our personal data or our premises where we process personal data?
  • Will this supplier provide services that will host or operate systems that will hold or process our personal data?

If the answer to either question is yes, then you need to involve your DPO in the supplier assessment process.  As with any process, there are always a few ‘rabbit holes’ to look out for.  Here a few to consider:

  • In some organisations, departmental or functional heads have the ability to sign off services up to certain spend limits, without having to go through formal procurement or supplier engagement processes. And whilst there may not be a big spend involved, there could be a big risk in terms of non-compliance with the GDPR.
  • Staff policies often contain statements relating to the installation of software on company equipment, but no restrictions on acquiring ‘online’ services.  As such, before you know it, your personal data may end up being processed or accessible by an unknown third party offering a ‘free’ service.
  • Some supplier relationships are based on long-term business opinion or service experience, without a contract at all.  As we know, this can be dangerous ground with personnel and structural changes to the organisation, e.g., mergers, takeovers
  • Big and small technical departments alike often circumvent the process when under pressure to deliver new or upgraded technology.  The supplier management process must link into IT change management and IT project management to identify those seemingly innocent tools, plug-in apps and cloud ‘platform’ services.  All of these can have implications for protecting personal data and, ultimately, the responsibility lies with you!

Do you need assistance in improving your GDPR compliance position?

URM can offer a host of consultancy services to improve your DP policies, privacy notices, DPIAs, ROPAs, privacy notices, data retention schedules and training programmes etc.
Thumbnail of the Blog Illustration
Data Protection
Published on
28/2/2024
GDPR - Back to Basics

URM’s blog explains the core principles which underpin the GDPR and outlines some key policies that can help organisations achieve and maintain compliance.

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
22/7/2022
Supply Chain Compliance with the GDPR

This blog focuses on an aspect of the GDPR which can be particularly challenging for a number of organisations.

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
13/6/2022
UK International Data Transfer Agreement

DTA and the UK Addendum to the current European Commission’s SCCs re the next steps in providing a transfer tool for complying with the UK GDPR.

Read more
Complicated topic summarised really simply making GDPR accessible. I would love a recording as was distracted part way through and would like to re-enforce my knowledge by listening again (possibly a couple of times just to get it to sink in......)
Webinar 'GDPR - Back to Basics'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.