Data Controller

Why Data Processors Need Two Information Protection Policies

May 10, 2024
Posted in

This entry explains why data processors (in particular) should have two distinct complementary types of information protection policies: one outlining the information security practices related to the services they provide data controllers, and another covering how they protect the vital information used to run their business. All modern data protection regulations require data controllers (clients)…

Read More
The word VENDOR is shown in red letters through a magnifying glass.

What Business Services are Data Processors, and Why Does It Matter?

April 15, 2024
Posted in

This entry is intended to help both novice and veteran data protection professional appreciate the number and types of service providers subject to the compliance requirements of privacy regulations. As far back as the mid 1990s, regulations have reflected the fact that data-related vendors, a.k.a., data processors, are critical to data controllers’ ability to protect…

Read More
Closeup photo of two people shaking hands

Data Controller/Data Processor Contracts #3:
Indemnification

January 15, 2024
Posted in

There may be no more confusing and misunderstood area of controller-processor contracts than insurance and indemnification. Controllers often expect processors to accept liability, while ignoring the quality (or existence) of processors’ underlying insurance coverage. Processors, on the other hand, often buy insurance products that provide minimal or no protection to meet those controller expectations. This…

Read More
Closeup image of a computer keyboard that has one key marked "Vendor Management" in red letters

Contractually Defining Information Custody Transfers

November 7, 2023
Posted in

KEY TAKEAWAYS: Information custody transfers are far more ubiquitous and riskier than most organizations appreciate. From a legal and regulatory perspective, “access to” equals “custody of.” There are specific elements and contractual assurances upon which all organizations should insist when transferring personal or proprietary information. Failure to obtain the appropriate assurances from any vendor accessing…

Read More
A closeup image of a person holding a pen and preparing to sign a document

Data Controller/Data Processor Contracts #1:
Applicability

July 17, 2023
Posted in

This blog explains why and when organizations should require contracts with service providers that have access to customer or employee personal information. One of the most underappreciated aspects of data controller/data processors contracts is when they are needed. This results from either 1) a lack of awareness of their necessity, or 2) the failure to…

Read More