Latest News

Data Protection Breaches - Recent Cases Data Protection Breaches - Recent Cases
EU Proposals for Data Protection Reform EU Proposals for Data Protection Reform
Parent Company Liable in Landmark Asbestos Case Parent Company Liable in Landmark Asbestos Case
Competition - New Market Investigation Competition - New Market Investigation
Companies Take Note - Dividends Can Be Proceeds of Crime Companies Take Note - Dividends Can Be Proceeds of Crime
Court Protects Wind Farmer When Board Freezes Him Out Court Protects Wind Farmer When Board Freezes Him Out
Budget Summary 2012 - Business Budget Summary 2012 - Business
Who Gives You Advice is Important Who Gives You Advice is Important
OFT Rejects Predatory Pricing Claim OFT Rejects Predatory Pricing Claim
Commerciality the Key in Contract Interpretation Commerciality the Key in Contract Interpretation

Outsourcing the Processing of Personal Information - Guidance

The Information Commissioner’s Office offers guidance for small businesses on how to comply with the Data Protection Act 1998 (DPA) when you outsource the processing of personal information, such as your payroll function or customer mailing information.

If you use an outside organisation to process personal information on your behalf, you remain responsible for the processing and will be liable for any breaches of the DPA. The Act requires that you take the appropriate technical and organisational measures to protect the information being processed whether this takes place in-house or whether someone else does it for you. In order to decide what measures are needed, the following should be taken into account:

  • what sort of information is being processed?
  • what harm might result from its misuse?
  • what technology is available to ensure the appropriate level of security?
  • what would be the cost of providing this level of security?

The guidance stresses that if you employ another organisation to process personal information for you, you must select one that you believe will carry out the work in a secure manner. Ongoing checks should be made to ensure that this is the case. Wherever the organisation is based, you must have a written contract with them. This should state that the personal data can only be used and disclosed in line with your instructions and that appropriate security measures must be taken.

If you are using an organisation based outside the European Economic Area, make sure the contract is enforceable in that country.

In summary, the good practice recommendations if you want to outsource the processing of personal data to an outside organisation are:

  • select a reputable organisation offering suitable guarantees as to their ability to ensure the security of the data;
  • make sure the contract is enforceable;
  • make sure the appropriate security measures are in place;
  • make sure that the organisation makes appropriate checks on its staff;
  • audit the organisation regularly to make sure it is up to standard;
  • require the organisation to report any breaches of security or other problems; and
  • put in place procedures that allow you to act appropriately if a problem is reported.

The guidance can be found on the Information Commissioner's website.

See also our guidance on the eight data protection principles.

The contents of this article are intended for general information purposes only and shall not be deemed to be, or constitute legal advice. We cannot accept responsibility for any loss as a result of acts or omissions taken in respect of this article.