Start with who decides and who acts
Personal data is information about an identifiable person. For a financial firm, that may include customer contact details, account records or information used to assess an application.
A controller decides why and how personal data is used. A processor handles it on the controller’s instructions. A payroll provider may be a processor for its client. But not every supplier is a processor: some make their own decisions about data and act as separate controllers. Check the actual relationship.
Why this matters
Using another company does not remove your own data-protection duties. If customer information is lost, exposed or used wrongly, people can suffer harm. Your supplier checks and contract should reflect the data, service and risk involved.
Controllers and processors have their own legal responsibilities. Liability depends on the duties and facts involved. It is too simple to say that a controller is automatically responsible for every act of every supplier.
Check that the provider is suitable
Under UK GDPR, controllers must use processors that provide sufficient guarantees that the processing will meet the rules and protect people’s rights. In practice, ask for evidence relevant to the service. Check access controls, staff responsibilities, recovery arrangements and how incidents are handled.
Certificates and independent reports can help. Read their scope, dates and findings. A well-known brand or a completed questionnaire is not enough on its own. Keep a record of why the provider is suitable and review the arrangement as risks change.
Put the required terms in writing
A controller-processor arrangement needs a binding written contract or other legal act with the required terms. People often call this a data processing agreement, or DPA. It should describe the processing and cover instructions, confidentiality, security and the use of other processors.
It must also address support with people’s rights, relevant compliance duties, data return or deletion and information or audits needed to show compliance. Check that the contract reflects the real service. A generic document can miss important details.
Know who else handles the data
A processor may use another provider, called a sub-processor. Check the authorisation process and how the required obligations are passed on. Understand where the data goes. If it is transferred outside the UK, assess the relevant international-transfer rules as a separate part of the review.
Prepare for problems before they happen
Agree who contacts whom if data is lost or accessed without permission. A processor must tell its controller about a personal data breach without undue delay. The controller then assesses its own reporting duties. Set practical contact and escalation arrangements so the right people can act quickly.
A data protection impact assessment, or DPIA, is required where processing is likely to create a high risk to people’s rights and freedoms. This is about the possible harm to people, not simply the possible fine for the business.
Keep the checks useful
Record the data involved, supplier role, contract, key evidence and open actions. Give each action an owner. Review important changes and check that promised fixes have been made. For financial firms, connect the review to the customer services that depend on the supplier.
Logica helps teams organise these checks and turn gaps into practical action. Explore our third-party risk management service or discuss your situation.
Read the ICO guidance on controllers, processors and contracts and its DPIA guidance.