Another GDPR query
Discussion
This should be a fairly simple question but it's started bit of a debate here. We are a small printing company. We print books, brochures, leaflets etc... Occasionally a customer will ask us to mail the printed products to the end users and will send us a spreadsheet containing names and addresses of the end users. We don't do mailing in house so we outsource this to a mailing house and pass the personal data to them.
In this scenario, who is the controller and who is the processor? Is there a sub-processor?
Trying to work out what contracts need to be in place.
In this scenario, who is the controller and who is the processor? Is there a sub-processor?
Trying to work out what contracts need to be in place.
My understanding is that you and the mailing house would both be processors. The controller being your customer.
However you would be controller of the information about your customer - and the mailing house a processor of that information.
I presume you are informing your customers that a 3rd party will be doing the mailing.
However you would be controller of the information about your customer - and the mailing house a processor of that information.
I presume you are informing your customers that a 3rd party will be doing the mailing.
andyb28 said:
In my opinion
Data controller - your client
Processor - you
Sub Processor - the 3rd party
Cheers. This was my understanding too. Our customer is the controller, we are the processor, the mailing house is a sub-processor. In this scenario, what contracts need to be in place?Data controller - your client
Processor - you
Sub Processor - the 3rd party
maffski said:
My understanding is that you and the mailing house would both be processors. The controller being your customer.
However you would be controller of the information about your customer - and the mailing house a processor of that information.
I presume you are informing your customers that a 3rd party will be doing the mailing.
Cheers. Yes, our customers know that we don't do mailing in house and this is outsourced.However you would be controller of the information about your customer - and the mailing house a processor of that information.
I presume you are informing your customers that a 3rd party will be doing the mailing.
Slightly different scenario. Once a year we do a job for one of our customers who is a graphic designer. The job is an annual membership mailing for a club. The graphic designer designs the job and sends the artwork to us to print. The club sends its mailing list (names and addresses) to the graphic designer who forwards it to us. Once we've printed the job we send it to the mailing house with a copy of the mailing list and they do the mailing.
Same questions. Who's the controller, processor, sub-processor? What contracts need to be in place?
Same questions. Who's the controller, processor, sub-processor? What contracts need to be in place?
toddler said:
Slightly different scenario. Once a year we do a job for one of our customers who is a graphic designer. The job is an annual membership mailing for a club. The graphic designer designs the job and sends the artwork to us to print. The club sends its mailing list (names and addresses) to the graphic designer who forwards it to us. Once we've printed the job we send it to the mailing house with a copy of the mailing list and they do the mailing.
Same questions. Who's the controller, processor, sub-processor? What contracts need to be in place?
The Club determine the purpose and manner for which the data is used (and presumably collect the data in this case) so they are the Data Controller (and also a processor, as they are collecting, storing and transferring the data to others). The designer is a processor, you and the mailing house are sub processors.Same questions. Who's the controller, processor, sub-processor? What contracts need to be in place?
The Controller should be looking to understand the data flow, so they can communicate openly with the data subject. There should be terms all the way through the chain to determine the scope of what the processors should/shouldn't be doing, to allow the controller to communicate this.
maffski said:
If you can get your end customer to send the list directly to the mailing house then it removes you from the GDPR processing chain - making life easier for you and your end customer.
ThisFrom what you have said, there is no legitimate legal or contractual (with the data subject) reason for you to hold the personal data in the mailing list
Since I posted my original question yesterday morning, we have received emails from three customers asking for a "Data Processing Agreement" (DPA). We have a signed DPA with one of our customers, a large public body, but they sent it to us to sign. I was expecting our customers (as data controllers) to send us their own DPAs for our signature, rather than asking us to send them a DPA. Am I misunderstanding?
RicksAlfas said:
Toddler, I am in exactly the same position as you. I am going to a BPIF course on Tuesday so I will let you know the outcome as this is one of my questions.
Brilliant, thank you very much. What course are you going on? I might try and get on one myself if it's not too late. I really am out of my depth with all this GDPR stuff, it's not my area and I've been dropped in the deep end with no support and no resources.This one:
https://www.britishprint.com/bpif-events/?acc=1&am...
They are (or have been) running it throughout the country, so there maybe one near you.
https://www.britishprint.com/bpif-events/?acc=1&am...
They are (or have been) running it throughout the country, so there maybe one near you.
RicksAlfas said:
This one:
https://www.britishprint.com/bpif-events/?acc=1&am...
They are (or have been) running it throughout the country, so there maybe one near you.
Thanks. I've sent them an email.https://www.britishprint.com/bpif-events/?acc=1&am...
They are (or have been) running it throughout the country, so there maybe one near you.
toddler said:
Since I posted my original question yesterday morning, we have received emails from three customers asking for a "Data Processing Agreement" (DPA). We have a signed DPA with one of our customers, a large public body, but they sent it to us to sign. I was expecting our customers (as data controllers) to send us their own DPAs for our signature, rather than asking us to send them a DPA. Am I misunderstanding?
I am seeing quite a mess in this area at the moment. I agree with the logic that you would expect to see the Data Controller by virtue of being the Data Controller and your Customer presenting their terms to their processors. However, I have more often seen the scenario you describe. In it's extreme I have seen this scenario where the processor was threatened by a major European manufacturer that they may not be able to continue business if the processor did not provide the agreement.My gut feel is that the customers are trying to shortcut their obligation by passing the risk to you, but can't see that this working by virtue of them being the Controller.
My recommendation is for you to develop your own general terms that cover what you do (that can be amended to cover different processing activities for different customers), so that you can respond positively, then wait for them to inevitably come and tell you they can't agree to them.
That said, I'd like to hear if others have a preferable approach than this!
Australiam said:
toddler said:
Since I posted my original question yesterday morning, we have received emails from three customers asking for a "Data Processing Agreement" (DPA). We have a signed DPA with one of our customers, a large public body, but they sent it to us to sign. I was expecting our customers (as data controllers) to send us their own DPAs for our signature, rather than asking us to send them a DPA. Am I misunderstanding?
I am seeing quite a mess in this area at the moment. I agree with the logic that you would expect to see the Data Controller by virtue of being the Data Controller and your Customer presenting their terms to their processors. However, I have more often seen the scenario you describe. In it's extreme I have seen this scenario where the processor was threatened by a major European manufacturer that they may not be able to continue business if the processor did not provide the agreement.My gut feel is that the customers are trying to shortcut their obligation by passing the risk to you, but can't see that this working by virtue of them being the Controller.
My recommendation is for you to develop your own general terms that cover what you do (that can be amended to cover different processing activities for different customers), so that you can respond positively, then wait for them to inevitably come and tell you they can't agree to them.
That said, I'd like to hear if others have a preferable approach than this!
I have developed a DPA (based on much Googling and copy&paste) but have no idea if it's any good.I'm on the scrounge. Does anyone have a Data Retention Policy & Schedule they would be willing to share with me, or a link to a free one I can download. Spent most of yesterday trying to put one together from scratch but just felt like I was reinventing the wheel. We're a bog standard small company with the usual records: HR, finance, purchasing etc... so I imagine our Data Retention Schedule will look 90% like any other small company.
Your data retention policy could be as simple as 'We do not keep data for longer than is necessary for the purpose for which it has been collected'
By schedule, I assume you mean a list of data types, and the corresponding duration that you intend to keep the data for?
The schedule will be dependant on the purpose for which the data is being collected. A data mapping exercise will typically help you understand why data is collected, you will then know how long it should be kept for, and can build the schedule (and depending on your size of organisation, this will also help create your records of processing)
Though there will be commonalities, for example where there is a legal requirement, such as the retention of data as required by HMRC, but beyond those, your schedule will likely be different from everybody else.
Gassing Station | Business | Top of Page | What's New | My Stuff