³ÉÈËÓ°Òô

View the related checklists about Data processor

Outsourcing by financial services firms—UK MiFID II Organisational Regulation, FCA Handbook, PRA Rulebook and UK GDPR—checklist

Outsourcing by financial services firms—UK MiFID II Organisational Regulation, FCA Handbook, PRA Rulebook and UK GDPR—checklist Financial services and data protection regulatory regimes Financial services firms need to ensure that their outsourcing arrangements comply with outsourcing requirements of two separate regulatory regimes: • the financial services regulatory regime, consisting principally of: ◦ Commission Assimilated Retained Regulation (EU) 2017/565 (the UK MiFID II Organisational Regulation) ◦ the Senior Management Arrangements, Systems and Controls sourcebook (SYSC) in the Financial Conduct Authority (FCA) Handbook, and ◦ the Outsourcing Part of the Prudential Regulation Authority (PRA) Rulebook, as well as • the data protection regulatory regime, consisting principally of the onshored General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) The Checklist provides high-level guidance on the outsourcing requirements of the two regulatory regimes and is intended to be a first step towards establishing a unified compliance programme. For detailed information on the outsourcing requirements of the UK MiFID II Organisational Regulation, the FCA Handbook and the PRA Rulebook, see Practice Note: Financial...

EU GDPR—audit of a new or existing personal data processor—checklist

EU GDPR—audit of a new or existing personal data processor—checklist This Checklist sets out key considerations a controller should typically take into account when conducting an audit for the purposes of evaluating the suitability of a prospective or existing processor of personal data under the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR). Note that this Checklist considers provisions under the EU GDPR applicable in EEA states at the supranational level only—refer to guidance from the relevant national data protection authorities and national laws regarding the approach that may be taken in any EEA jurisdiction. For further information about the EU GDPR, see Practice Note: The EU’s General Data Protection Regulation (EU GDPR). Audits of processors Although processors subject to the EU GDPR have their own particular responsibilities under the legislation, controllers remain responsible for the processor’s processing of personal data under their instructions. Under: • the accountability principle of the EU GDPR: the controller is responsible for, and must be able to demonstrate compliance with, the data...

View the related flowcharts about Data processor

EU GDPR—personal data breach notification—flowchart

EU GDPR—personal data breach notification—flowchart The EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) is directly applicable and fully enforceable in EU and EEA states. This Flowchart focuses on personal data breach notification under the EU GDPR. It covers: • a summary of the overarching obligations • key guidance • types of personal data breaches • the flowchart of notification requirements • general examples of personal data breaches and who to notify • detailed examples of personal data breaches and who to notify The EU GDPR includes the following definition of a personal data breach: ‘…a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.’ Overarching obligations In summary, among other things, the EU GDPR provides that: • data processors must notify the data controller without undue delay after becoming aware of a personal data breach • unless the personal data breach is unlikely to result in a risk to the rights...

View the related practice notes about Data processor

Key definitions under the DPA 1998 [Archived]

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). This Practice Note is for background information only and is not maintained.BackgroundThe DPA 1998 governs processing of personal data in the UK. It obliges processors of such data to comply with eight principles, and gives individuals a right to know what information is held about them. For further information on the principles, see Practice Note: Data protection principles under the DPA 1998.The Information Commissioner's Office (ICO) supervises and enforces the implementation of the DPA 1998. For more information, see Practice Notes: The Information Commissioner’s Office (ICO) and Sanctions and enforcement under the DPA 1998.Sections 1 and 2 of the DPA 1998 contain definitions for the key terms used throughout the act and within the Information Commissioner's codes of practice or other guidance. Key statutory definitions include:•Data•Personal data•Sensitive personal data•Data subject•Data controller•Data processor•Processing•Relevant filing systemChanges as a result of the General Data Protection...

Applicability and scope of the DPA 1998 [Archived]

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). This Practice Note is for background information only and is not maintained.This Practice Note concerns the applicability and territorial scope of the DPA 1998. When considering the applicability of the DPA 1998, look at the following:•the type of data being processed—the DPA 1998 applies only to the processing of personal data, other data (eg statistical or other data which does not relate to an identifiable individual) is not covered•where the data controller is established—the DPA 1998 applies only to data controllers who are established in the UK and who process personal data in the context of that establishment. This covers UK based data controllers who process data connected to a UK business even if technically the processing takes place overseas (eg using servers located in another country)•the equipment/location of processing—where a non-UK, non-EEA data controller processes personal data using equipment located in...

View the related precedents about Data processor

Share purchase agreement—pro-buyer—corporate seller—conditional—long form

Share purchase agreement—pro-buyer—corporate seller—conditional—long form This Agreement is made on [insert day and month] 20[insert year] Parties 1 [Insert name of selling corporate entity] incorporated in [England and Wales OR [insert country of incorporation] OR with registered number [insert company number] whose registered office is at [insert address] (the Seller); 2 [Insert name of purchasing corporate entity] incorporated in England and Wales OR [insert country of incorporation] OR with registered number [insert company number] whose registered office is at [insert address] (the Buyer), and 3 [Insert name of guarantor entity] incorporated in England and Wales OR [insert country of incorporation]] with registered number [insert company number] whose registered office is at [insert address] (the Guarantor) [(each of the Seller, the Buyer and the Guarantor being a Party and together the Seller, the Buyer and the Guarantor are the Parties).] Background (A) The Company (as defined below) is a private company limited by shares and is incorporated in [England and...

Share purchase agreement—pro-buyer—individual sellers—conditional—long form

Share purchase agreement—pro-buyer—individual sellers—conditional—long form This Agreement is made on [insert day and month] 20[insert year] Parties 1 The several persons whose names and addresses are set out in Schedule 1 (together the Sellers), and 2 [Insert name of purchasing corporate entity] incorporated in [England and Wales OR [Insert country of incorporation]] with registered number [insert company number] whose registered office is at [insert address] (the Buyer), [(each of the Sellers and the Buyer being a Party and together the Sellers and the Buyer are the Parties).] Background (A) The Company (as defined below) is a private company limited by shares and is incorporated in[ England and Wales OR [insert country of incorporation]]. Details of the Company are set out in Schedule 2, Part A. (B) The Sellers are the legal and beneficial owners of the Sale Shares (as defined below), being in aggregate the entire allotted and issued share capital of the Company. (C) The Sellers have agreed to sell and the...

View the related q&as about Data processor

Under the General Data Protection Regulation, Regulation (EU) 2016/679, is it permissible for a data processor to charge a data controller for assisting with migration of personal data to the controller (or a third party) when the relevant agreement governing the processing (eg outsourcing agreement) terminates?

Under the General Data Protection Regulation, Regulation (EU) 2016/679, is it permissible for a data processor to charge a data controller for assisting with migration of personal data to the controller (or a third party) when the relevant agreement governing the processing (eg outsourcing agreement) terminates? We assume that this Q&A is referring to the General Data Protection Regulation, Regulation (EU) 2016/679, Art 28(3)(g) (the GDPR): ‘…That contract or other legal act shall stipulate, in particular, that the processor… at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data…’ Article: GDPR series: Outsourcing contracts—all changed, changed utterly?—PDP 18 4 (3) explains ‘Separate to the issue of liability is the issue of allocation of costs

Under each of the Data Protection Act 1998 and the General Data Protection Regulation (as it applies in the UK), can a data controller be fined for breaches of the controller’s obligations under that data protection law where that breach of law occurs due to the acts or omissions of a data processor?

Under each of the Data Protection Act 1998 and the General Data Protection Regulation (as it applies in the UK), can a data controller be fined for breaches of the controller’s obligations under that data protection law where that breach of law occurs due to the acts or omissions of a data processor? Data Protection Act 1998 It is the data controller's responsibility to comply with the Data Protection Act 1998 (DPA 1998) rather than the data processor. Therefore, it must ensure that it imposes all necessary obligations in relation to data protection on the data processor through a contract. The relationship between controller and processor is reflected in the seventh principle of DPA 1998, which requires the data controller, where it appoints a data processor to (among other things): • carry out the processing under a contract made or evidenced in writing • require the data processor to act only on instructions from the data controller, and • require the data processor to comply with obligations equivalent...

View the related News about Data processor

Information Law weekly highlights—17 October 2024

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

Comment—software providers look exposed to mass claims in the EU over cyberattack damage

MLex: A recent update to the EU's product liability rules is giving tech companies sleepless nights over whether they could be held liable for data losses caused by cyberattacks.