startEnsuring third parties are compliant
How To

Ensuring third parties are compliant

CCH GDPR Compliance
Last update: Reading time 3 minutes
GDPRGetting Started

    Most organisations share personal data with a handful (or maybe dozens) of third parties. If you’ve provided that personal data to a third party, your organisation has some liability as to how the third party uses it. Do you know if that third party is GDPR compliant? Are their data protection practices acceptable? It’s fine to share personal data with third parties, but you must have a written agreement with them stipulating how they can process and what they can do with the data you have given them.

    Take care before you share

    When creating your data inventory, you recorded the third party processors and controllers that personal data was shared with. Maybe you added your cloud provider, your payroll processors or your CRM. CCH GDPR Compliance gives you a third party processors log and a controller’s data processing log where you can record all receipts by third parties of your data subjects’ personal data.

    clipboard_ec38de997bd785ed8d70683fbbacc9b12.png

    Against each third party, you can detail exactly what they are doing with the personal data and exactly what personal data from which data subjects you have shared with them. CCH GDPR Compliance will use this information to generate a data processing agreement. You can send it to the processor and then upload the signed copy to CCH GDPR Compliance.

    What if the processor is outside the EU?

    If a third party processor is outside the EU, the law requires extra-legal protection to be in place. If the country is outside the EU, you will need a legal basis you are using for exporting that personal data outside the EU. CCH GDPR Compliance lets you record this legal basis and provides you with a copy of the model contract the EU suggests organisations use when exporting personal data outside the EU.

    Sharing data with controllers

    Are you sharing data with another controller? A travel agent passing personal data of its clients to a hotel or an airline is an example of this type of transfer of data between controllers. Each is a separate controller, individually responsible for data protection. Data is still being shared with a third party, but the legal relationship changes since they are now using the personal data you’ve shared with them for their own purposes. These controller-to-controller relationships must be mapped and can be listed in the Data Sharing register.

    When different controllers play a role in processing personal data, compliance with data protection rules and responsibilities for possible breaches still need to be clearly allocated. It is also important that a clear notice is given to the data subjects, explaining the various stages and actors of the processing. It should be made clear that every controller is competent to comply with all data subject's rights and which controller is competent for which right.

    How sharing with controllers differs from sharing with processors:

    • How personal data is being used by the controller and where legal responsibilities for each party begin and end.
    • Different legal document from a data processing agreement.
    • Model Agreement – in the event data is shared with a controller outside the EU – is different because it contains controller-to-controller clauses.

    Related documents

    CCH GDPR Compliance  MFA
    The document outlines the implementation of multi-factor authentication (MFA) for users of the CCH GDPR Compliance application to enhance account security. It explains that users must provide two factors for access, specifically a password and a verification code sent via SMS or generated through a time-based one-time password (TOTP) app, such as Google Authenticator or Microsoft Authenticator. Instructions for downloading these apps and setting up SMS verification are provided, along with visual aids for the login process and MFA selection.
    Stakeholder training and awareness
    The document discusses the importance of staff awareness and compliance in data protection programs within organizations. It highlights the necessity of training employees on relevant policies and providing documentation of their understanding and acceptance. The CCH GDPR Compliance tool is introduced, which allows organizations to distribute policies, track employee receipt and acceptance, and monitor compliance status with visual indicators. It emphasizes the need for a record of training efforts and offers templates for communication, ensuring all employees are informed and compliant.
    Simplifying Data Subject Access Requests (DSAR)
    This document outlines the rights of individuals regarding their personal data and how organizations can facilitate the exercise of these rights. It emphasizes the importance of allowing easy access to rights through communication channels. The process for handling Data Subject Access Requests (DSAR) is detailed in three steps: receiving and logging requests via a customizable online form, validating requests by confirming the requester's identity, and responding appropriately to the request while ensuring compliance. The document stresses the importance of training staff and maintaining records for accountability and transparency.
    Responding to data breaches
    This document discusses the importance of effective breach management in compliance with GDPR, highlighting the challenges many organizations face in acknowledging breaches. It introduces CCH GDPR Compliance as a solution, detailing its workflow for logging breaches, managing responses, and assessing incidents. Key features include understanding causes, assembling response teams, risk evaluation, and facilitating communication with supervisory authorities and affected data subjects. The tool also provides downloadable reports and maintains a historical breach log for future learning and prevention efforts.
    Do you need a Data Protection Officer?
    The document emphasizes the importance of human involvement in achieving GDPR compliance, highlighting that organizations must protect individuals' data through established processes. It introduces CCH GDPR Compliance as a collaborative workflow tool where team administrators can grant access to users, including external Data Protection Officers (DPOs). The document outlines the necessity of appointing a qualified DPO based on regulatory requirements and encourages organizations to assess their need for one. For questions regarding DPO appointments, it directs readers to CCH Software Support for assistance.