What Is A Third Party Processor?

When you use advertising tools such as a facebook pixel or when you rely on third party payroll software, you inevitably allow these service providers to collect and process personal data for your business operations. Under the GDPR, a service provider like this is called a “third party processor”.

When you use these third-party processors, you need to comply with the specific obligations set by the UK GDPR such as signing a data processing agreement with them. If you fail to comply with the GDPR, you may get slapped with penalties and regulatory action.

For instance, the French Data Protection Authority imposed a €1.5m fine on a software publisher “Dedalus”. One of the violations found was the non-compliant data processing agreement because this agreement did not contain the necessary elements.

In this article, we will walk you through who third-party processors are, GDPR obligations to lawfully use these processors, and how you can comply.

To eliminate GDPR risks related to third party processors, keep reading!

What is a third party data processor?

Under the UK GDPR, a third-party processor is defined as “a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.” This processor signs a data processing agreement with the controller and this agreement includes rules about how data will be collected and used.

Put simply, Amazon, the online business that sells goods online (the data controller) decides on what data to collect and how to use, process and retain such data. A third-party processor such as payment processor (like Stripe) or cookie provider carries out processing activities on this data under the instructions of this data controller.

Third party processor examples

Here are some examples of the different types of third party processors:

• Payment Processors: Companies like PayPal, Stripe, or Square process payment transactions on behalf of businesses, handling sensitive customer data like credit card details.
• Cloud Storage Providers: Services like Google Drive, Dropbox, or Microsoft OneDrive store and manage data for businesses, acting as processors for the information uploaded by the data controller.
• Email Marketing Platforms: Platforms such as Mailchimp, HubSpot, or Constant Contact process personal data (like email addresses) to send newsletters or promotional emails on behalf of businesses.
• Customer Relationship Management (CRM) Systems: Tools like Salesforce or Zoho manage and process customer data, helping businesses organise and utilise customer information efficiently.
• Human Resource Services: Platforms like Workday or ADP process employee data, including payroll and benefits information, on behalf of organisations.

Think about when Amazon sells goods though their website. When customers place an order, Amazon will collect their personal data such as their names, email addresses, credit card information, and physical delivery addresses.

Therefore, Amazon will be deciding what information to collect, how to collect it, and where to store the data and for how long. Under the UK GDPR, Amazon is a “data controller”.

However, this business will likely rely on third party tools when selling goods online. For example, it may use a third party cookie on its website to store products placed in shopping baskets by customers. Furthermore, it can also use a third-party processor like Stripe to process payments made.

In these instances, these third parties don’t make any decisions on how personal data will be used, they just process this personal data under the instructions of the data controller. 

These third-party service providers are called third party processors under the UK GDPR.

What are the benefits of using a third party processor?

• Ease of setup: Third party processors are straightforward to set up, requiring minimal integration efforts. This allows businesses to start accepting payments quickly without the need for extensive technical knowledge.

• Cost-effective: They typically have lower upfront costs compared to building a custom solution, making them accessible to small businesses and startups.

• Scalability: Third party processors offer scalability, allowing businesses to grow and handle increased transaction volumes without needing to invest in additional infrastructure or resources.

Processors vs joint controllers vs sub-processors

In the section above, we explained the difference between the data controller (Amazon) and the third-party data processor (Stripe).

Alongside third party processors, there may be other parties that may collect and process personal data.

Let’s now examine these other parties to understand the difference between third party processors and other parties:

• Joint controller: Joint controller is a third party data controller that exercises joint control over the purposes and means of data processing activities. For example, when you operate a Facebook page, your business and Facebook are “joint controllers”. In this case, Facebook and your business sign a “Joint Controllership Agreement”

• ‍‍Sub-processor: When a third party processor processes personal data on behalf of a data controller, it can use other third parties’ services and allow these third parties to access and process the data controller’s personal data. Processors engaged by the third party processor are called “sub-processors”. For example, when a website uses Google Analytics on its website, Google becomes its third party processor. Google may store data collected through Google Analytics on a cloud provided by another company. This cloud provider is a sub-processor. The third party processor and sub-processor signs a data sub-processing agreement, which is separate from the data processing agreement entered into between the data controller and third-party processor.

What is required when a third party company processes personal data?

Under the UK GDPR, the data controller bears ultimate responsibility and this covers third party processors it uses as well. Therefore, the data controller should engage third-party processors in compliance with the GDPR requirements.

Full compliance can only be achieved by having a complete, accurate and up-to-date picture of all third party processors, how they operate, what data they process and where and how they store data. 

Therefore, you need to do the following to identify third party processors and implement appropriate measures:

• Identify all the third party processors you use: as a company you will use different processors, you have to ensure that they are GDPR compliant as well, so keep a complete and up-to-date list of all the third-parties you engage with.

• Data mapping: You need to map how data flows across your organisation, from its collection to its deletion (including the data that goes to your third party processor

• Sign Data Processing Agreements: Under the UK GDPR, your data processing agreement with your third party processors must contain specific clauses. Furthermore, your processors must enter into data sub-processing agreement with their subprocessors. These sub-processing agreements must include the same obligations in your data processing agreement.

How to ensure your third party processors meet the requirements of the GDPR

Under the UK GDPR,  the data controller bears full responsibility for its processors’ compliance with the GDPR. Therefore, you need to implement appropriate measures to ensure that your processor processes personal data in compliance with the GDPR.

The key to ensuring your processors are compliant with GDPR is by signing a Data Processing Agreement (DPA) with your processors. As data controller, this is a legal requirement as per Article 28 of the GDPR. This Data Processing Agreement must include specific terms. 

This agreement must at least address the following issues:

• Instructions: Processors will process data only on documented instructions from the data controller.

• Duty of confidentiality: Processors must ensure that any third party that processes personal data will be subject to confidentiality obligation.

• Security measures: Processors must implement all necessary security measures as required under article 32 of the GDPR.

• Sub-processors: The processor should not engage another processor (a sub-processor) without the controller’s prior specific or general written authorisation.

• Data subject rights: Processors shall help controllers effectively satisfy data subject requests such as a data subject access request.

• Assistance to controller: Third party processors shall provide assistance to controllers to help with various GDPR compliance matters.

• End of the processing agreement: The agreement shall state that the third party processor will delete data upon the end of the agreement.

In addition to having a DPA, you should also find out about the following to identify and minimise risks:

• Where and how does the third party processor store personal data?

• Is there a notification procedure for overseas transfer of personal data?

• Are there appropriate security controls in place to identify and minimise risks?

• Is there a breach response procedure in place?

• Is there an international data transfer? For example, if your processor is located in the United States or if it uses sub-processors such as Amazon Cloud to store data, you need to comply with international data transfer requirements under the GDPR.

If you act mainly as a data processor, you will need a standard data processing agreement that you sign with each of your clients. For instance, Hubspot mainly provides services as a data processor and it has a standard data processing agreement which you can find here.

Consequences of non-compliance with the GDPR processing regulations

If you fail to map all your data flows and identify your third party processors, you will not be able to enter into data processing agreements with them. What is more, you will not be able to assess and minimise risks related to your third party processors.

When you fail to comply with these obligations under the UK GDPR, you may face the following fines:

• An individual may sue you, the data controller, at court for damages.

• The UK Data Protection Authority (“ICO”) may impose a fine up to £17.5 million or 4% of the total annual worldwide turnover in the preceding financial year, whichever is higher.

To avoid these GDPR fines and to benefit from the services of third party processors, you need a practical tool that can map your data, identify your processors and create appropriate agreements.

This is why you should give Privasee a chance to help you satisfy these GDPR compliance requirements.

With Privasee, you can...

• Set and forget: Once your policies and agreements are set up, Privasee ensures they remain updated automatically, freeing you from ongoing maintenance.

• Tailor solutions without the cost: Enjoy customised privacy policies and cookie banners designed to meet your specific needs without the high cost of bespoke solutions.

• Have your compliance on autopilot: Privasee keeps your website compliant with the latest regulations effortlessly, automatically updating policies as laws change, ensuring continuous compliance without manual intervention.

To comply with the GDPR requirements without expending excess resources, try the Privasee platform here.

Key Takeaways & Wrap Up

In this article, we have helped you understand the following:

• A third party processor is an individual or a legal person that processes personal data under the instructions of a data controller. This processor is in a direct relationship with the controller and acts in this controller’s interest.

• Data controller and processor must enter into a data processing agreement under article 28 GDPR and this agreement must include specific terms such as the handling of data subject requests and appropriate security measures.

• To use third party processors in compliance with the GDPR, you need to map all data flows and identify your third party processors.

‍

Third party processor FAQs

How does data privacy work with third party processors?

Third party processors must comply with data protection regulations like GDPR. They implement strict security measures, such as encryption and secure data storage, to protect customer information and ensure compliance with legal requirements.

Can I use multiple third party processors for my business?

Yes, businesses can use multiple third party processors to offer customers various payment options. This can enhance customer satisfaction by providing preferred payment methods, though it may require managing different fee structures and integration processes.

How do I comply with GDPR when using third party processors?

To comply with GDPR, you need to map all data flows, identify your third party processors, and ensure that a data processing agreement is in place under Article 28 GDPR. This agreement outlines all the requirements and liability in relation to Personal Data when working with the processor.