We need data processing agreements in place - Aberystwyth

Whenever a supplier touches personal data, written processing terms are mandatory. International transfers need an additional lawful mechanism.

• Mapping controller, processor and joint controller roles
• Article 28 clauses and sub-processor controls
• International data transfer agreements and risk assessments

Who is the controller?

Whoever determines the purposes and means of processing - this is a factual question, not just what the contract says.

What covers transfers outside the UK?

The UK addendum to the EU standard contractual clauses or the International Data Transfer Agreement, plus a transfer risk assessment.

• Data processing agreements in Cardiff86 firms
• Data processing agreements in Swansea32 firms
• Data processing agreements in Newport31 firms
• Data processing agreements in Bridgend12 firms
• Data processing agreements in Caerdydd10 firms