There are two sides to the coin of data protection (both currently under the Data Protection Act and going forward under the GDPRs) - the concepts of data controller and data processor.

Most business will certainly be data controllers (in terms of employee personal data) and some businesses will also be data processors (e.g. if they host or provide outsourced services such as payroll where they might hold personal data of its customer’s employees). If you’re not sure of the difference don’t worry we will go over this but you may want to read our blog beforehand to help. If you are a data controller and data processor, you will have to comply with both the data processor and the data controller obligations under the GDPRs.

The first half of the sprint will be spent focussing on data protection and the GDPRs from a data controller’s point of view. This will include going over the concepts of accountability, individual’s rights, DPO requirements and Privacy by Design.

We will then move on to data processor obligations. For the first time, data processors will be liable by law - which means that it can be held directly liable under a statute in addition to any contractual liability it agrees to with the data controller or sub-processor. We will go over contract requirements, controller instructions and data breaches.

Identifying when you are a data controller or data processor and understanding the impact on your customer and supplier contracts will be useful.