Data Management and GDPR
Written Arrangements
  1. Context: with regard to common processing operations for purposes as set out in a direct contract between controllers, or indirectly through them with other controllers that provide services, including a memorandum of understanding or similar agreement, the parties in their legitimate interests acknowledge the joint processing of personal data, including determining the purpose and means of processing.  In order to preserve the integrity of the personal data and manner processed, each controller (“parties” or “party”) acknowledges their part in ensuring the system, processes and organisational set-up are fit-for-purpose, and accepts their respective roles and responsibilities, as laid out here, to minimise the likelihood of any unauthorised or unlawful processing of the personal data,
  2. These written arrangements are referred to in information sharing agreements between joint controllers and reflect the duties and tasks of parties involved.  They are a technical and organisational measure to address the varying likelihood and severity of risks to the rights, freedoms, and interests of affected individuals with respect to the joint processing of their personal data for the stated purposes.  They cover obligations to address data protection principles, legal basis, security measures, data breach notification obligation, data protection impact assessments, the use of processors, international transfers of personal data, and contacts for individuals and the regulator.  The roles and responsibilities of the involved parties are the service and system management, support, and provision of collecting, processing, sharing, storing, and deleting personal data.
  GENERAL
  1. Each party shall be accountable for their respective data protection obligations.
  2. Each party shall define their respective data protection obligations precisely.
  3. At the time of the determination of the means and at the time of the joint processing itself, each party shall be responsible for demonstrating compliance with data protection by design by implementing appropriate technical and organisational measures designed to support the data protection principles effectively and maintain an appropriate level of security proportionate to the risks presented by the processing.
  4. The pre- and post-processing shall be separate from the joint processing and subject to other arrangements and legal bases where applicable.
  CONTACT AND COMMUNICATIONS BETWEEN PARTIES
  1. Each party shall notify other parties of their designated contact, who shall through agreed channels manage any communications relating to data protection matters, such as rights requests by individuals, personal data breaches or other incidents, and enquiries from supervisory or competent authorities.
  2. Where individuals bypass their designated contact, and contact another party, they shall be referred back to the designated contact without undue delay, and in any case within 24 hours.
GENERAL PRINCIPLES OF DATA PROTECTION
  1. In relation to the joint processing and for the state purposes, each party shall observe the general principles of data protection.
  2. Regarding the principle of lawfulness, fairness and transparency, each party shall:
    1. have in place adequate policies and training outlining the principles to be followed by its employees and workers to ensure personal data is processed fairly, lawfully, transparently and in a manner consistent with its legitimate business interests.
    2. provide in its privacy notice the essence of these arrangements including at least that:
      1. personal data is jointly processed with other parties in our legitimate interests for the stated purposes including profiling;
      2. individuals may exercise their right to request further details at any time; and
  • contact details to correspond with regarding data protection matters.
  1. Regarding the principle of purpose limitation, each party shall:
    1. process personal data for the stated purposes, including profiling;
    2. respect the limitations of processing such personal data for further processing activities and purpose(s) after the joint processing, including conducting a compatibility test for any new purpose(s) and
      1. where not compatible with current purposes, undertake not to process personal data for that new purpose without authority to do so;
      2. where compatible, further consider additional technical and organisational measures as required, and inform the other parties of the intention to do so.
    3. respect the limitations of any prior purpose(s) and associated processing before the joint processing.
  2. Regarding the principle of data minimisation, each party shall only process personal data that is adequate, relevant and limited to what is necessary for the stated purposes or as obligated to do so by law.
  3. Regarding the principle of accuracy, each party shall:
    1. ensure that processing remains accurate, and, where necessary, kept up to date; and
    2. take every reasonable step to ensure that any inaccurate personal data, having regard to the stated purposes, are erased or rectified without delay.
  4. Regarding the principle of storage limitation, each party shall:
    1. keep such personal data in a form which permits identification of individuals for no longer than is necessary for the purposes for which the personal data are processed.
    2. specify in its policy documentation procedures for the tracking and deletion of personal data according to their retention schedules.
    3. retain personal data for the duration of the business relationship between the parties or until instructed to delete personal data under the terms of a contract, except where lawfully required to retain the personal data for longer.
  5. Regarding the principle of integrity and confidentiality, each party shall:
    1. process in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.
    2. have in place adequate documentation including policies and employee or worker contracts, clearly designating any personal data as confidential to allow its legitimate, authorised processing of personal data.
    3. in relation to introducing new parties to the common processing activities, a party wishing to introduce a new party to the processing in any capacity shall do so based on the appropriate authority.
    4. in relation to transferring personal data to third countries or international organisations, any transfer shall be subject to a transfer test and where applicable appropriate technical, contractual and organisation measures shall be applied, such as encryption, at least to meet to the four ‘essential guarantees’.
  6. Regarding the principle of accountability, each party shall:
    1. manage risk adequately including necessity, proportionality and legitimacy tests, data protection impact assessments, legitimate interest assessments, and transfers tests, as required.
    2. make any risk assessment available to the other parties upon reasonable request.
    3. maintain a record of processing activities including in particular a list of recipients of the personal data, which must be provided to the other parties upon reasonable request as required without undue delay.
    4. log all individuals rights request as per data protection obligations.
LEGAL BASIS OF PROCESSING
  1. Each party acknowledge that personal data is shared and processed in relation to the stated purposes including profiling based on:
    1. legitimate interests for general processing, whilst
    2. for special categories of personal data, the processing is necessary for
      1. the purposes of carrying out the obligations and exercising specific rights of the party or of the individual in the field of employment and social security and social protection law, or
      2. if applicable, reasons of substantial public interest as laid down by legislation.
    3. Each party shall state the legal bases it relies upon for any additional specified, explicit and legitimate purposes that it processes personal data for, which shall be proportionate to the legitimate aim pursued, and, in particular, refer to:
      1. the types of data which are subject to the processing;
      2. the individuals concerned;
      3. the entities to, and the purposes for which, the personal data may be disclosed;
      4. purpose limitation;
      5. storage periods; and
      6. processing activities and processing procedures, including measures to ensure lawful and fair processing.
    4. Each party shall be responsible for undertaking its own necessity, proportionality and legitimacy tests to justify further processing, taking upmost account that such purposes are not incompatible with the stated purposes by undertaking a compatibility test taking into account, inter alia:
      1. any link between the stated purpose and the intended further purposes;
      2. the context in which the personal data have been collected, in particular regarding the relationship between individuals and the respective party as well as other parties that may be involved with the processing activities;
      3. the nature of the personal data, in particular whether special categories of personal data are processed, or whether personal data related to criminal convictions and offences are processed;
      4. the possible consequences of the intended further processing for individuals;
      5. the existence of appropriate safeguards, which may include encryption or pseudonymisation.
    5. The legal basis for all processing, including general processing as well as processing of special categories of personal data, shall be documented appropriately and made available upon reasonable request to other parties involved with the joint processing.
DATA PROTECTION IMPACT ASSESSMENTS
  1. Each party shall undertake its own data protection impact assessment (“DPIA”) with regards to the joint processing to set out which party is responsible for the various measures designed to manage or mitigate any identified risks and to protect the rights, freedoms, and interests of individuals, in particular regarding automated decision-making, special categories of personal data, or where the individual is a child.
  2. Each party shall provide practical assistance upon reasonable request to another party undertaking its DPIA.
  3. Each party shall consider completing a DPIA for any further planned processing activities that is large scale; involves profiling or monitoring; decides on access to services or opportunities; or involves sensitive data or vulnerable individuals.
  4. Unless the party has already conducted a substantially similar DPIA, each party shall undertake DPIAs for any further planned processing activities and associated purpose(s) which in particular are likely to result in a high risk or as identified by the regulator.
  5. When undertaking a DPIA, the party shall take utmost account of applicable statutory data protection and other relevant codes including the age-appropriate design code (also known as the Children’s code) or Data Sharing code.
  6. When undertaking a DPIA, the party shall take utmost account of risks to the rights and freedoms of individuals caused by the nature, scope, context and intended purpose(s).
  7. When undertaking a DPIA, the party shall take utmost account of any:
    1. concerns affected individuals may have.
    2. impact that stakeholders may have including on other parties involved with the processing activities such as processors, controllers, and joint controllers.
    3. any concerns the data protection officer may have, if appointed.
SECURITY MEASURES
  1. For personal data that is processed for the stated purposes or any further processing activities and associated purpose(s), each party shall have in place appropriate technical and organisational measures so that personal data shall be processed in a manner that ensures a level of security appropriate to the personal data being processed, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
  2. Each party shall be able to demonstrate the ability to:
    1. manage their respective security risk
      1. taking appropriate steps to identify, assess and understand security risks to personal data and the systems that process such data;
      2. implement appropriate organisational structures, policies, and processes to systematically manage security risks to personal data;
  • in particular risks relating to processing activities that may arise as a result of engaging other parties such as controllers, joint controllers, and / or processors, including ensuring that they employ appropriate security measures, such as, in the case of processors, requiring sufficient guarantees about their technical and organisational measures.
  1. protect personal data against cyber-attack with proportionate security measures which cover the personal data processed as well as the systems that process such data, these measures to include compliance with any Information Security policies:
    1. the security of data by implementing technical controls (such as appropriate encryption) to prevent unauthorised or unlawful processing of personal data, whether through unauthorised access to user devices or storage media, backups, interception of data in transit or at rest or accessing data that might remain in memory when technology is sent for repair or disposal.
    2. training staff by giving appropriate support to help them manage personal data securely, including the technology they use;
  • monitoring authorised user access to that data, including anomalous user activity, recording user access to personal data.
  1. having processes in place, where unexpected events or indications of a personal data breach are detected, to act upon those events as necessary in an appropriate timeframe.
  1. minimise the impact of a personal data breach, restore systems and services, including the availability and access to personal data in a timely manner in the event of a physical or technical incident, manage incidents appropriately, and learn lessons for the future, by:
    1. effective response and recovery planning;
    2. taking steps, when a personal data breach occurs, to understand the root cause, take appropriate action, including, documenting lessons learned, and, where required, reporting the breach to the ICO, the National Cyber Security Centre, other relevant bodies, and affected individuals.
PERSONAL DATA BREACH NOTIFICATIONS
  1. For personal data that is processed for the stated purposes or any further processing activities and associated purpose(s), when identifying a personal data breach referred to in the sub-paragraph of this clause, each party shall without undue delay, and in any case within 24 hours of becoming aware of the personal data breach, inform other parties about the nature, scope and context of the personal data breach where required, and
    1. agree which party is the source of the personal data breach, and
    2. that party shall take the lead in managing the personal data breach including investigating it, undertaking appropriate risk assessments, and managing any remediation, including providing any required notifications.
  2. A personal data breach is as defined by the UK GDPR, including that in particular ‘unauthorised or unlawful processing may include disclosure of personal data to recipients who are not authorised to receive (or access) the data, or any other form of processing which violates the UK GDPR – the consequence of such a breach being that the parties will be unable to ensure compliance with the principles relating to the processing of personal data.’
  3. Where a party is required to inform the other party of a personal data breach, such notification should include the likely consequences of the breach, as well as the measures taken or proposed to be taken by the party if applicable to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects, such consequences including:
    1. the inability to comply with data protection obligations; and
    2. the realistic identification of the potential range of significant adverse effects on individuals, which can result in physical, material, or non-material damage, such as loss of control over their personal data, limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, and loss of confidentiality of personal data protected by professional secrecy, as well as any other significant economic or social disadvantage to those individuals, in particular where such adverse effects on individuals may wholly or partially, directly or indirectly, lead to a further event or incident because of or as well as, for example, a further breach of legal obligations which the parties are beholden to – e.g. Health and Safety at Work Act 1974, etc.
  4. Each party shall ensure for their respective part that a description of the nature, scope and context of the personal data breach are recorded and logged, including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records.
  5. Each party shall assist the other party in notifying the personal data breach to the ICO where required, including providing the information in 7.2 and 7.3 upon reasonable request.  The parties shall define all the elements to be provided by the party identifying a personal data breach when assisting each other in the notification of a personal data breach to the ICO.
THE USE OF PROCESSORS
  1. For personal data that is processed for the stated purposes or any further processing activities and associated purpose(s), each party shall ensure, in order to satisfy the accountability principle and demonstrate due diligence, by way of a binding contract or other legal act, that any processors it relies upon:
  2. only process personal data in line with the party’s written instructions within the terms (unless it is required to do otherwise by law), which set out the extent of the processing that the processor is contracted, including:
    1. the subject matter and duration of the processing;
    2. the nature and purpose of the processing;
    3. the type of personal data and categories of affected individuals; and
    4. the party’s obligations and rights.
  3. provide sufficient guarantees, in particular in terms of its expert knowledge, resources and reliability, that they will implement appropriate technical and organisational measures to ensure the security of personal data, such as using encryption and pseudonymisation.
  4. ensure their processing meets data protection obligations, including:
    1. protecting against accidental or unlawful destruction or loss, alteration, unauthorised disclosure or access, through:
      1. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
      2. the ability to restore access to personal data in the event of an incident; and
  • processes for regularly testing and assessing the effectiveness of the measures.
  1. demonstrating they are competent to process the personal data in line with those data protection obligations, such as maintaining records, appointing a data protection officer, and allowing the party to conduct timely audits, inspections or assessments, to demonstrate the processor’s data protection obligations have been met, taking into account the nature of the processing and the risks to the data subjects.
  2. obtaining a commitment of confidentiality from anyone it allows to process the personal data, unless that person is already under such a duty by statute, covering their employees as well as any temporary workers and agency workers who have access to the personal data.
  1. shall not engage another processor (i.e. a sub-processor)
    1. without the party’s prior specific or general written authorisation
    2. where such authorisation is given, the processor shall demonstrate it has in place a contract with the sub-processor with terms that offer an equivalent level of protection for the personal data as those in the contract between the processor and the party.
  2. inform the party without undue delay if:
    1. any of party’s instructions would lead to a breach of data protection obligations; or
    2. they become aware of a personal data breach, taking utmost care to notify, the party within 24 hours, and assist the party in complying with its obligations regarding personal data breaches.
  3. only transfer outside the UK when authorised to do so and ensure that such transfers comply with the transfer provisions as laid down by data protection obligations
  4. assist the party where required in meeting its obligations to keep personal data secure, notify, where required, the ICO and affected individuals, and carry out DPIAs.
  5. cooperate with supervisory authorities (such as the ICO) to help them perform their duties as required.
  6. take appropriate technical and organisational measures to help the party respond to requests from individuals to exercise their rights.
  7. at the end of the contract, in a secure manner, and, at the party’s choice, delete or return to the party all the personal data it has been processing for it unless UK law requires it to be stored.
INTERNATIONAL TRANSFERS OF PERSONAL DATA
  1. In relation to a party exporting personal data to a third country or international organisation {recipient), and including onward transfers by that recipient, in relation to the stated purposes or any further processing activities and associated purpose(s), where the recipient is not covered by an adequacy decision, the party shall check that enforceable data subject rights and effective legal remedies for data subjects are available, in addition to documenting (and making available to the other party upon reasonable request) one of the required appropriate safeguards or exceptions as data protection obligations, where:
  2. any routine restricted international personal data transfer that relies on an international data transfer agreement is subject to an international transfer risk assessment (TRA) prior to the transfer.
  3. any more complex restricted international personal data transfer (such as where the recipient is based in more than one country) is, in addition to completing a TRA, subject to a DPIA, and the implementation of any necessary further contractual, technical and organisational measures to sufficiently mitigate risks, including relying on another appropriate safeguard or exception or not proceeding where there is an enhanced risk.
  4. any unrestricted international personal data transfer Is subject to contractual clauses that commit the recipient to their data protection obligations to facilitate the exercising of data subject rights as well as the ability of data subjects to seek administrative and judicial redress and to claim compensation in the UK and the destination country, including where the recipient is a:
    1. controller, their responsibilities, DPIAs, security measures, and transfers or disclosures not authorised by UK law.
    2. processor (or sub-processor), their processor contract, security measures, and transfers or disclosures not authorised by UK law.
INDIVIDUALS’ RIGHT TO EXERCISE THEIR RIGHTS
  1. Each party shall provide any individual wishing to exercise their rights directly with the other party the details of other party’s designated single point of contact.
  2. Each party shall handle any rights requests without prejudice and act to respond or otherwise provide for these requests without undue delay, and in any case within 1 month, or as required by data protection obligations.
  3. Each party shall validate any rights request against their record of processing activities.
  4. Each party shall fulfil any rights requests in a secure manner, including, security of communications and transmission of personal data.
  5. In relation to right of access, each party shall
    1. respond as to whether or not personal data is being processed; and
    2. provide the individual with information as laid down by data protection legislation including with regards to the purpose(s) and legal basis for the processing; and
    3. provide a copy of the personal data being processed.
  6. In relation to right to data portability, where relevant, each party shall
    1. refer the individual for any data portability requests received directly from individuals concerning personal data entered by the other party, who shall resolve any referred or direct data portability requests with the individual.
  7. In relation to right to rectification, each party shall
    1. rectify any inaccurate personal data upon request by individual; and
    2. refer the individual to the other party for any data rectification requests concerning personal data entered by the other party, and the other party shall resolve any referred or direct right to data rectification requests.
  8. In relation to right to erasure, each party shall
    1. determine if any of the applicable grounds for erasure as laid out by the data protection legislation apply;
    2. if grounds do not apply inform individual that the request may not be fulfilled.
    3. if grounds apply immediately erase any personal data as per data protection obligation; and
    4. inform any recipient of the valid erasure request; and
    5. inform the individual of these recipients if requested by the individual.
  9. In relation to right to restriction of processing,
    1. if the relevant party no longer needs the personal data for the purposes of the processing, but they are required by the individual for the establishment, exercise or defence of legal claims restrict processing immediately, then the party shall inform the other party without undue delay, and in any case within 24 hours.
    2. if the individual requests restriction pending the verification of the legitimate grounds of either party overriding those of the individual in connection to a right to object request, then the party shall
      1. restrict processing immediately, and
      2. inform the other party without undue delay, and in any case within 24 hours.
    3. In relation to right to object, if the individual objects to the legitimate interest of either party in processing or sharing their personal data the respective party shall demonstrate compelling legitimate grounds for the processing which overrides the interests, rights and freedoms of the individual or for the establishment, exercise or defence of legal claims, and, if unable to do so, cease processing immediately and notify the other party of valid objection request without undue delay, and in any case within 24 hours.

Contact us to experience how we deliver on your project and business strategy

View a live PowerHouse Upskill portal to understand more about how our modules, features and functions will give you the power and flexibility to deliver your project your way.

Download the PowerHouse Upskill Brochure
Download the PowerHouse CPD Brochure
Download the PowerHouse Recruit Brochure

Contact us to request a free demo

Contact us to arrange a free demo and our product experts will be able to show you how the PowerHouse Upskill and Recruit will be able to deliver your eLearning, workforce compliance or recruitment portal.