Skip to main content
Hafan

Third party arrangements

Download options

Contents

Control measure: Arrangements are in place with joint controllers in the event of a personal data breach.

Risk: Without an understanding and agreement about the respective responsibilities for joint controllers in the event of a personal data breach, there is a risk that they will go undetected and as a result unreported. Without documented responsibilities in transparent arrangements between the controllers, there may be a breach of UK GDPR article 26.

Ways to meet our expectations:

  • Identify any controllers who you jointly process information with. 
  • Determine with joint controllers your respective responsibilities for handling personal data breaches.
  • Agree communication channels between the parties in the event of a personal data breach, including nominated points of contact.
  • Test breach communication channels and procedures with joint controllers.

Options to consider:

  • Agree secondary nominated points of contact in the event of absence and document the out of hours arrangements.
  • Keep the arrangements under review following any personal data breaches or near misses.

Control measure: Contracts are in place between the controller and any processors working on their behalf that reflect the processor's obligations in the event of a personal data breach.

Risk: Without an agreement outlining the processors obligations in the event of a personal data breach, there may be a breach of UK GDPR articles 28, 32-36. 

Ways to meet our expectations:

  • Put in place contractual agreements with processors that specify how to meet the requirements of article 33 of the UK GDPR and each parties' responsibilities if a personal data breach occurs.
  • Include any agreed arrangements for the processor to report a personal data breach on your behalf.
  • Agree and document timescales for processors to report suspected personal data breaches to you. 
  • Agree communication channels between parties in the event of a personal data breach and nominated points of contact.

Options to consider:

  • Agree secondary nominated points of contact in the event of absence and document the out of hours arrangements.
  • Keep contractual agreements under review and following any personal data breaches or near misses.