1. What is Sub-processing of Personal Data?
One of the main objectives of the General Data Protection Regulation (GDPR) is to make all data processing stakeholders dealing with the data of European residents accountable, whether these actors are data controllers or subcontractors. The controller is “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”. The subcontractor, in turn, “processes personal data on behalf of,on instruction and under the authority of a controller”. The GDPR has deeply redesigned the outlines of the relationship between these two entities.
2. The impact of the GDPR on sub-processing agreements
As a data controller, you must ensure, in addition to the obligations relating to your respective roles, that your co-contractors involved in the processing of personal data comply with the GDPR. The GDPR sets out new specific obligations for subcontractors to support the data controllers notably in their ongoing process of compliance. Their rights and responsibilities have therefore been substantially reinforced (transparency and traceability requirements, guarantee of security, assistance, alert and counsel etc).
Given this profound redefinition of the roles of each party in the context of subcontracting relations, it is essential to contractualise the obligations of each of the parties in the interests of clarity, transparency and legal certainty. The impact of the GDPR on the contractual relations you have with your subcontractors is therefore monumentous.
3. LegalUP Consulting’s service
In this context, LegalUP Consulting offers customised assistance solutions to assist data controllers and subcontractors in their contractual relations. It will be necessary to define in a precise, clear, and exhaustive way the role of each party to the contract in the compliance with the GDPR, and to anticipate the respective responsibilities for the sake of legal certainty for your organisation in view of the heavy penalties incurred in the event of non-compliance with GDPR obligations. LegalUP Consulting’s service covers a large number of diligences: the drafting of standard contracts, the review of your current contracts (and if necessary the production of amendment clauses for them), the drafting of future contracts, the support during negotiations and / or the suggestion of creative solutions for your documentation while preserving a “tech and business friendly” approach.
LegalUP Consulting’s service is delivered in three stages, with three calls (telephone or video-conference) allowing a personalised execution adapted to your needs:
First of all, we invite you to book an appointment for an initial call of 15 minutes. Appointments are made via an online calendar which you can access by clicking on the button at the bottom of the page. During this first call, we will present the service offered by the firm, we’ll specify the first documents to send us for the smooth running of the service, and we’ll set a cost estimation that will be confirmed in writing as soon as possible.
We will also take advantage to respond to any eventual questions you may have about the service.
Following the first call, we will send you a quote, a link to make the payment and a letter of commitment that you must return signed by email. Upon receipt of the letter of commitment and confirmation of payment, we will start processing your request. To do this, a second call of 45 minutes will allow us to identify the specific needs of your organisation to deliver a tailor-made service. You may also book an appointment for this second call online, by clicking on the button at the bottom of this page, or via the link we will send you by email following our first call.
3 working days (flexible period defined by the parties in the case of complex requests) after the second call, we will get back to you via email for the execution of the service. You will also receive a link simultaneously which will enable you book an appointment for a third call of 15 minutes during which we will present you the result of our work in a detailed way and will submit you personalised recommendations.