Third-Party Management
Data Processors, When Another Company Handles Personal Data for You
How Jamaican businesses can identify data processors, understand their responsibilities and keep a processor register under the Data Protection Act.
What you will learn
- What makes a supplier a data processor
- Three questions to assess a supplier's role
- Why processor management still matters after you share data
- What to record in a processor register
Businesses increasingly rely on third parties. Examples include:
- payroll platforms;
- website hosting;
- cloud storage;
- email platforms;
- accountants;
- CRM systems;
- marketing platforms;
- IT providers; and
- payment services.
But not every supplier automatically has the same data-protection role. A data processor processes personal data on behalf of a data controller and under the controller's authority and instructions.
Ask three questions
- Does this organisation handle personal data? If no, it is unlikely to be a processor for that activity.
- Whose purpose is being fulfilled? If the supplier processes information on your behalf to provide a service to you, processor considerations arise.
- Who determines what happens to the data? Roles must be assessed based on the actual relationship rather than merely the name given in a contract.
Why processor management matters
Giving information to another organisation does not mean your responsibility simply disappears. Your organisation should understand:
- what the provider receives;
- why;
- where processing occurs;
- security controls;
- subcontractors;
- retention;
- deletion;
- breach procedures; and
- contractual responsibilities.
Build a processor register
Jamaica Privacy Hub allows you to connect processors directly to processing activities, so you can see which parts of your business rely on each provider.
Put this into practice
Keep a processor register and connect processors to processing activities.
Review My ProcessorsFrequently asked questions
Key takeaways
- A data processor processes personal data on behalf of a controller and under its instructions.
- Assess a supplier's role from the actual relationship, not just the contract label.
- Sharing data with a supplier does not make your responsibility disappear.
- Keep a processor register and link processors to your processing activities.