Supply Chain Compliance with the GDPR

If you are a data controller, you are required to protect the rights of individuals, including the secure processing of their data.  This obligation entails passing compliance measures down to any external organisations that process or access your data via contractual conditions.  Sounds straightforward, eh?  You just issue a contract change note or GDPR contract addendum to all your existing suppliers.  Unfortunately, it gets a bit trickier when it comes to new suppliers.  How do you assess whether the new supplier has sufficient security controls in place to protect your personal data to a level that is equal to, or greater than, your own?

The answer is to ensure that you have a data protection/GDPR specialist involved in the onboarding of any new suppliers.  Typically, this individual would be your data protection officer (DPO), who is responsible for assessing the controls a potential new supplier has in place to protect personal data and would ultimately have the power to veto any contract being signed.

‍

We often find the supplier onboarding process misses some fundamental trigger questions, namely:

• Will this supplier’s services require access to our personal data or our premises where we process personal data?
• Will this supplier provide services that will host or operate systems that will hold or process our personal data?

If the answer to either question is yes, then you need to involve your DPO in the supplier assessment process.  As with any process, there are always a few ‘rabbit holes’ to look out for.  Here a few to consider:

• In some organisations, departmental or functional heads have the ability to sign off services up to certain spend limits, without having to go through formal procurement or supplier engagement processes. And whilst there may not be a big spend involved, there could be a big risk in terms of non-compliance with the GDPR.
• Staff policies often contain statements relating to the installation of software on company equipment, but no restrictions on acquiring ‘online’ services.  As such, before you know it, your personal data may end up being processed or accessible by an unknown third party offering a ‘free’ service.
• Some supplier relationships are based on long-term business opinion or service experience, without a contract at all.  As we know, this can be dangerous ground with personnel and structural changes to the organisation, e.g., mergers, takeovers
• Big and small technical departments alike often circumvent the process when under pressure to deliver new or upgraded technology.  The supplier management process must link into IT change management and IT project management to identify those seemingly innocent tools, plug-in apps and cloud ‘platform’ services.  All of these can have implications for protecting personal data and, ultimately, the responsibility lies with you!

‍