How does the GDPR affect third-party and customer contracts?
The GDPR places equal liability on data controllers (the organization that owns the data) and data processors (outside organizations that help manage that data). A third-party processor not in compliance means your organization is not in compliance. The new regulation also has strict rules for reporting breaches that everyone in the chain must be able to comply with. Organizations must also inform customers of their rights under GDPR.
What this means is that all existing contracts with processors (e.g., cloud providers, SaaS vendors, or payroll service providers) and customers need to spell out responsibilities. The revised contracts also need to define consistent processes for how data is managed and protected, and how breaches are reported.
“The largest exercise is on the procurement side of the house—your third-party vendors, your sourcing relationships that are processing data on your behalf,” says Mathew Lewis, global head of banking and regulatory practice at legal service provider Axiom. “There’s a whole grouping of vendors that have access to this personal data and GDPR lays out very clearly that you need to ensure that all of those third parties are adhering to GDPR and processing the data accordingly.”
Client contracts also need to reflect the regulatory changes, says Lewis. “Client contracts take a number of different forms, whether they are online click-throughs or formal agreements where you make commitments to how you view, access, and process data.”
Before those contracts can be revised, business leaders, IT, and security teams need to understand how the data is stored and processed and agree on a compliant process for reporting. “A pretty sizable exercise is required by the technology groups, the CISO, and data governance team to understand what data fits within the firm, where it’s being stored or processed, and where it’s being exported outside the company. Once you understand those data flows and the impact on the business, you can start to identify the vendors you need to be most focused on both from an information security perspective, how you manage those relationships going forward, and how you memorialize that in the contract itself,” says Lewis.
The GDPR might also change the mindset of business and security teams toward data. Most companies see their data and the processes they use to mine it as an asset, but that perception will change, says Lewis. “Given GDPR’s explicit consent and firms needing to be much more granular in their understanding of data and data flows, there’s a whole set of liabilities that now exist with the accumulation of data,” says Lewis. “That’s quite a different frame of mind both for legal and compliance, but maybe more important for the way the business thinks about the accumulation and usage of that data and for information security groups and how they think about managing that data.”
“Data is leaving the firm in all kinds of ways,” says Lewis. “While the CISO and the technology groups need to be able to track all of that, you also need to put protection in place.” Those protections need to be spelled out in the contract so the outside firms understand what they can and cannot do with the data.
Lewis notes that by going through the process of defining obligations and responsibilities, it prepares a company to handle GDPR compliance operationally. “If one of your vendors says, ‘You were hacked last night,’ did they know who to call and how to respond as part of meeting the regulatory requirements,” he says.
The 72-hour reporting window that the GDPR requires makes it especially important that vendors know how to properly report a breach. “If a vendor was hacked and you’re one of the thousands of clients, do they notify your procurement department or an account person or someone in accounts receivables? It could come in all kinds of ways,” says Lewis.
You want a clearly defined path in the contract for the information to get to the person in your organization responsible for reporting the breach. “A regulator is not going to say you shouldn’t have had a breach. They are going to say you should have had the policies, procedures, and response structure in place to solve for that quickly,” says Lewis.
