GDPR for IT suppliers to European and UK public bodies

If you build, host or support systems that hold personal data for a European or UK public body, the GDPR applies to you, wherever your firm is based.

Controller and processor

• The controller decides why and how personal data is processed. That's usually the public body.
• The processor processes data on the controller's behalf. That's usually you.

Processors have direct legal obligations under the GDPR, and the contract with the controller must cover set terms.

What the data processing agreement covers

Article 28 of the GDPR requires a written contract that includes:

• Processing only on the controller's documented instructions.
• Confidentiality for anyone with access.
• Appropriate security measures.
• Using subprocessors only with permission, under the same terms.
• Helping the controller respond to individuals' rights requests.
• Helping with security, breach notification and DPIAs.
• Deleting or returning data at the end.
• Allowing audits.

Public buyers usually provide their own data processing schedule. Read it carefully.

Breach notification

Controllers must usually notify the regulator within 72 hours of becoming aware of a personal data breach. So contracts require processors to notify the controller without undue delay, often within 24 or 48 hours. Make sure your incident process can meet it.

International transfers

Transferring personal data outside the EEA (or the UK, under UK GDPR) needs a legal basis, such as an adequacy decision or standard contractual clauses. Canada has an EU adequacy decision covering organizations subject to its federal private sector privacy law, and the UK recognizes it too, which helps Canadian firms. Check how it applies to your situation. Remote access from abroad by support staff can count as a transfer.

See data residency and sovereignty.

What to show in a bid

• Your role and a willingness to sign the buyer's data processing terms.
• Hosting locations and subprocessors.
• Security controls and certifications, such as ISO 27001.
• Your breach response process and timings.
• How you support DPIAs. See privacy impact assessments.
• Staff training on data protection.

Common questions

Does GDPR apply to non-EU companies working for EU public bodies?

Yes. If you process personal data on behalf of an EU controller, the GDPR's processor rules apply, and contracts will require you to follow them.

What is a data processing agreement?

It's the contract between a controller and processor setting out how personal data will be handled, as required by Article 28 of the GDPR.

Is the UK GDPR different from the EU GDPR?

They're very similar. The UK kept the GDPR in its own law after leaving the EU, with some differences in transfers and enforcement.