Transferring customers' personal data to an external processor

When is a supplier a processor and when are they not

The decisive question is who determines why and how data is processed. Whoever determines the purposes and means of processing is the controller. Whoever works with the data only according to their instructions and for their needs is a processor. A cloud CRM provider, an external payroll accountant, an e-shop platform operator, or a call center are typical processors if they work with data only according to your instructions; a bank or insurance company that handles your employees' data for its own purposes is not a processor.

If processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organizational measures (Article 28 of the General Data Protection Regulation). Choosing a supplier is therefore not just a business decision: you bear responsibility for whom you have chosen and you should be able to demonstrate how you assessed their guarantees.

The boundary is not fixed, however. A processor that violates the regulation by determining the purposes and means of processing itself is considered a controller in relation to such processing. An agency that also uses your contacts for another client's campaign thereby ceases to be your processor and becomes an independent controller with all the obligations that entail.

In practice, it is good to have an overview of how many such relationships a company actually has. An average medium-sized company usually has more processors than the legal department registers: in addition to the main systems, there is a meeting booking tool, a questionnaire service, external IT support with access to databases, or an archiving company. Each of them needs a contract, and for each, you need to know where the data physically resides.

What a data processing agreement must contain

A data processing agreement, often referred to by the abbreviation DPA, is a contract required by the regulation between a controller and a processor. It must set out the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. It must be in writing, with electronic form being sufficient.

The regulation further lists what the agreement must set out in particular regarding the processor's obligations. The processor processes data only on documented instructions from the controller, including with regard to transfers to a third country. It ensures that persons authorized to process the data have committed themselves to confidentiality. It takes the required security measures and complies with the conditions for engaging another processor. It informs the controller if, in its opinion, an instruction infringes data protection regulations.

The second group of obligations concerns cooperation. The processor assists the controller in responding to data subjects' requests, such as for access or erasure, and in meeting obligations regarding security, breach notification, and impact assessments. As soon as it detects a personal data breach, it must report it to the controller without undue delay. This timeframe is crucial for you, because without timely information from the supplier, you cannot fulfill your own obligations to the authority or to the individuals whose data was leaked.

The third group addresses the end of cooperation and audits. Upon termination of services, the processor, at your choice, deletes or returns all data and deletes existing copies unless law requires their storage. At the same time, it provides you with all information necessary to demonstrate compliance with obligations and allows for audits, including inspections, conducted by you or an auditor you mandate. The context of audits by the authority is discussed in the article on GDPR audits in practice.

The list in the regulation is a minimum, not a ceiling. The agreement should also include what the regulation does not explicitly require, but without which obligations cannot be enforced: a specific timeframe for reporting a leak in hours, a list of sub-processors in an annex, the data storage location, contact persons, and penalties for breach. Which of these additional clauses is essential for a specific supplier depends on the volume and sensitivity of the data you transfer to them — which is why the scope of the contract is tailored by the Prague-based ARROWS legal team based on the type of processing, not according to a template.

Sub-processors: a chain that does not end with your supplier

The processor shall not engage another processor without prior specific or general written authorization of the controller. In the case of general written authorization, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. Specific authorization gives you greater control over each change, but is practically unenforceable with larger suppliers because they change their chain continuously.

For companies, the second half of this rule is more important, namely liability. If a processor engages another processor, it must impose the same data protection obligations on them by contract as it has towards you. If the other processor fails to fulfill its obligations, the initial processor remains fully liable to you for the performance of those obligations. Your supplier therefore cannot pass the failure of its subcontractor onto you.

In practice, it is therefore necessary to know who is in the chain. A cloud provider commonly uses data centers, customer support tools, and monitoring services from other companies, often based outside the European Union. Each such link is a point where data can leak or go to a third country. The conditions for transfers to third countries are governed by separate rules and must be explicitly included in the contract.

A reasonable standard is a general authorization with a list of existing sub-processors in an annex. In addition, an obligation to notify changes sufficiently in advance and your right to terminate the agreement if you do not agree with the change. How these rules apply to mobile applications and platforms is analyzed in the article on processing of personal data in applications.

Liability: who pays when a processor fails

Towards the individuals whose data was leaked, you as the controller bear broad liability even for processing carried out on your behalf. A processor is directly liable for damage if it has not complied with obligations of the regulation specifically directed to processors, or where it has acted outside or contrary to your instructions. The injured party can therefore turn to both you and the supplier. If both are responsible for the same damage, they can claim full compensation from either of them, and you will then settle the shares between yourselves.

Between you and the supplier, liability is then resolved according to the contract and the Czech Civil Code. If the supplier breaches a contractual obligation, they shall compensate for the damage resulting from it (Section 2913 of the Czech Civil Code). They are released from the obligation only if they prove an extraordinary, unpredictable, and insurmountable obstacle that arose independently of their will. The costs of investigating the incident, informing customers, and legal defense are items that will cost you dearly without a well-set contract.

Suppliers defend against this with a liability limit, usually in the amount of annual payments for the service. However, such a limit has legal boundaries. No regard is paid to an agreement that excludes or limits in advance the obligation to compensate for damage caused to a person's natural rights, or caused intentionally or through gross negligence (Section 2898 of the Czech Civil Code). The limit therefore does not cover cases where the supplier ignored basic security rules to such an extent that it constitutes gross negligence. Exactly where this boundary lies is assessed only according to the circumstances of the specific incident.

Whether the liability limit for a specific supplier corresponds to the risk is assessed based on the volume and sensitivity of the transferred data and the damage a leak would actually cause — which is why the lawyers of the Prague-based ARROWS law firm calculate it based on the type of processing, not on the price of the service.

Penalties and liability limits in the contract

Many data processing agreements contain a contractual penalty for breach of obligations, such as for late notification of a leak or for engaging a sub-processor without consent. A penalty motivates compliance, but there is a catch. If a contractual penalty is agreed upon, the creditor is not entitled to compensation for damage resulting from the breach of obligation to which the penalty applies (Section 2050 of the Czech Civil Code).

In the event of a data leak, the damage is usually orders of magnitude higher than any reasonably agreed penalty. Unless the contract stipulates that full compensation for damage can be claimed in addition to the penalty, the penalty will paradoxically narrow your claim. This single sentence belongs in every data processing agreement where you negotiate penalties; without it, the penalty becomes more of a protection for the supplier than for you.

Furthermore, the amount of the penalty is not certain in itself. An disproportionately high contractual penalty may be reduced by a court upon the debtor's proposal, taking into account the value and importance of the secured obligation (Section 2051 of the Czech Civil Code). The court does not assess the agreed amount as such, but the specific claim: how and under what circumstances the breach occurred and how it affected the interests that the penalty was intended to protect.

A reasonable compromise that is accepted in the market is a combination of a penalty and full compensation for damage. The penalty applies to procedural failures such as late notification or failure to notify a change of sub-processor, while full compensation for damage applies to the leak itself. In addition, a liability limit that applies specifically to data leaks and is higher than for standard service defects. It is also worth keeping records of the costs and impacts that the incident caused you, as these will show what interest the penalty protected.

Joint campaign: when you share data with a partner

A different situation arises when you do not send data to a processor but share it with a business partner for a joint purpose, typically for a joint marketing campaign, contest, or loyalty program. Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers (Article 26 of the General Data Protection Regulation). Simply sharing contacts does not mean this yet; what matters is whether both of you actually decide on the purpose and method of processing.

Joint controllers must determine their respective responsibilities in a transparent manner by way of an arrangement between them, in particular as regards the exercising of the rights of the data subject and their respective duties to provide information. A contact point may be designated in the arrangement. The arrangement must reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects, and the essence of the arrangement must be made available to the data subjects.

The fundamental difference compared to a data processing agreement is the position towards individuals. Regardless of how you divide the responsibility, a data subject may exercise his or her rights under the regulation in respect of and against each of the controllers. The internal division thus only protects the relationship between you and your partner, not you against the customer, who can choose from whom to enforce their rights.

In practice, this situation is often recognized too late. Companies enter into a business agreement with a partner for a joint event, share contacts, and there is nothing about data protection in it. If the partner then uses the data differently than agreed, you have no contractual support and you may still find yourself in the role of the one responsible for the processing towards customers.

How to negotiate a data processing agreement with a large supplier

With large cloud service providers, the data processing agreement is usually non-negotiable and offered in a standard version. This does not mean you should just sign it. You should read it and verify whether it contains all mandatory requirements, where the data is located, what the list of sub-processors is, and how quickly a leak is reported.

If the standard version is not enough, this is resolved by choosing a different service level, not by negotiating the text. Large suppliers offer different service levels with different terms, including data location within the European Union or extended audit rights. The difference in price is usually less than the costs that unfulfilled obligations would cause you.

With small and medium-sized suppliers, the situation is reversed. There, it pays to have your own template of a data processing agreement and insist on it, because suppliers often do not have their own template or use an incomplete one. How to proceed when ordering software or a cloud service overall is discussed in the article on custom software or SaaS orders.

The regulation also offers you facilitation. The agreement may be based, in whole or in part, on standard contractual clauses adopted by the European Commission. Using them simplifies negotiations because there is no dispute over the content of the mandatory provisions, leaving only the commercial parts to be negotiated, i.e., timeframes, limits, and penalties.

Errors that only show up during a leak

The most common mistake is a data processing agreement signed as a formality that nobody read. The company has it but does not know how quickly the supplier must contact them in the event of a leak, where the data is located, or who is in the chain of sub-processors. At the moment of an incident, they then resolve basic questions under time pressure.

The second mistake is the lack of an overview of which suppliers you actually have an agreement with. Tools introduced by individual departments without management's knowledge, trial versions of software, or services paid for with a company card often do not have an agreement. Yet, this is where data leaks most frequently, because nobody monitors their settings or who has access to them.

The third mistake is an agreement that does not specify what happens to the data after the cooperation ends. The supplier continues to store the data because they have no instruction to delete it, and you lose track of it. In the event of a later leak from their system, you may then be held responsible for data you did not know still existed. Therefore, the obligation to confirm deletion in writing belongs in the agreement.

The fourth mistake is overlooked joint controllership. A company considers a partner to be a processor and enters into a data processing agreement with them, although in reality both determine why the data is processed. Which type of contract is correct for your cooperation is assessed based on who actually decides on the purpose — and the entire division of liability stands on this, which is why the lawyers of the Prague-based ARROWS law firm evaluate this before signing.

Where a data processing agreement fails

Final Summary

The article has shown that a data processing agreement is not a formality, but the main tool with which you can control what a supplier does with your customers' and employees' data. The regulation sets out its mandatory content, and towards the individuals whose data you transfer, you as the controller bear broad liability even for processing carried out on your behalf. The agreement therefore determines what you will be able to claim back from the supplier.

For company management, two overviews that can be compiled quickly are essential. The first is a list of all suppliers who work with personal data, including tools introduced by individual departments. The second is the answer to three questions for each of them: where the data is located, how quickly they report a leak, and whether the liability limit covers the actual damage.

Delay does not pay off here, because you need to have the agreement before you transfer the data, and you cannot add it after an incident. Every month without an agreement is a month of processing that does not meet the requirements of the regulation. Companies that managed a leak without major losses had agreements with specific timeframes and knew everyone in the chain.

The general principles that should apply to the review of any commercial contract are summarized in the text on what a commercial contract review should contain — a DPA as a specific type of contract is just one of the cases where these rules apply.

The lawyers of the Prague-based ARROWS law firm will prepare and review data processing agreements and joint controller arrangements, vet your suppliers and their chain of sub-processors, negotiate terms with the counterparty, and represent you in claiming damages after a leak. Write to us at consultation@arws.cz or check out our service GDPR and Personal Data Protection.