{"id":18112,"date":"2022-06-20T11:57:45","date_gmt":"2022-06-20T10:57:45","guid":{"rendered":"https:\/\/www.rosello-mallol.com\/?p=18112"},"modified":"2023-04-27T11:45:14","modified_gmt":"2023-04-27T10:45:14","slug":"gdpr-compliance-provider-control","status":"publish","type":"post","link":"https:\/\/www.rosello-mallol.com\/en\/gdpr-compliance-provider-control\/","title":{"rendered":"GDPR compliance and provider control in 4 steps"},"content":{"rendered":"\n
The hiring of providers with access to personal data owned by our company is an undeniable fact and, over time, has been consolidated and expanded to include any type of organization, from the smallest to the largest. Therefore, some steps must be followed for GDPR compliance and provider control.<\/strong><\/p>\n\n\n\n In April\u2019s post<\/a> we focused on the difference between this access to data and the transfer of data to third parties<\/strong> (nothing to do with each other). Today, however, we want to expand on this and give to you the keys to understanding what to do to comply with the GDPR<\/strong> when a provider has access, for example, to the data of our customers, employees, leads, etc. By following these steps and asking these questions, you will be able to have a correct GDPR compliance and provider control.<\/p>\n\n\n\n Before this, however, some of the common cases of providers with data access are:<\/p>\n\n\n\n So let’s go through the 4 steps that must be followed to ensure access to the data by these providers, among others, complies with the GDPR:<\/p>\n\n\n\n One of your essential tasks as data controller is to ensure that these providers (data processors) access only the necessary data to provide the service<\/strong> and that the purpose of such access to the data is clearly identified. Providers, therefore, will never be able to access more data than they need to provide the service or exceed the purpose for which they have been given access to the data.<\/p>\n\n\n\n Very important<\/strong>. When reviewing compliance with the GDPR by the provider, you must ascertain the location from which they provide the service and, therefore, “where” the personal data to which they have access will go. Procurement of providers from outside the EU has special requirements (see Point 3).<\/p>\n\n\n\n Also, find out whether the chosen provider subcontracts part or all of its services, and again, where these subcontractors are located. As the controller, you must know the subcontractors and also authorize subcontracting by contract.<\/p>\n\n\n\n Globalization in the provision of services, especially digital, has made it possible for them to be provided from virtually anywhere in the world. What is easy for business can also be a challenge for compliance with the GDPR because it may, in practice, mean that personal data is hosted outside the EU. This fact, which is not forbidden<\/strong>, does imply that you must have or meet special requirements<\/strong>. Again, it depends on where this provider is located and, based on that:<\/p>\n\n\n\n\n
\n
\n
\n
\n