Controller or processor?
The controller decides why and how personal data is used. A processor handles it on the controller’s behalf. Your payroll bureau, IT provider or virtual assistant agency is usually your processor. You remain responsible for choosing processors that give “sufficient guarantees” of appropriate security.
The Article 28 contract
Article 28 of the GDPR requires a written contract with each processor. Among other things, it must say the processor will:
- act only on your documented instructions;
- keep the data confidential and secure;
- use sub-processors only with your authorisation;
- help you respond to people exercising their rights and to data breaches;
- delete or return the data when the service ends;
- allow and contribute to audits.
Sending data outside the UK or EU
Transfers to other countries need a legal basis, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or (in the UK) the International Data Transfer Agreement or the UK Addendum. US companies certified under the EU-US Data Privacy Framework can receive EU data on the basis of the adequacy decision for that framework.
Practical checklist
- List which suppliers handle personal data, and what data they handle.
- Get a data processing agreement signed with each one.
- Ask about security certifications, such as ISO/IEC 27001 or SOC 2.
- Check where data is stored and how transfers are covered.
- Review access when people or suppliers change.
A business lawyer can review contracts, and an IT security provider can check controls. Our sister site OnBusLaw covers online business law in plain English.
Last updated: 25 September 2026
