Obligations specific to this business.
WHAT ROLE YOU USUALLY HOLD
Processor, for customer data on your servers.
WHAT ROLE YOU ALSO HOLD
Controller, for your own customers' account details.
WHY BOTH MATTER
Different obligations apply to each.
WHAT YOU MUST PROVIDE AS A PROCESSOR
A data processing agreement Security measures Breach notification to customers Assistance with their obligations Deletion or return at the end A sub-processor list
WHAT SUB-PROCESSORS YOU LIKELY HAVE
Data centre operators Backup providers Email delivery services Monitoring tools Support platforms
WHAT TO PUBLISH
That list, kept current.
WHAT CUSTOMERS WILL ASK FOR
Where data is stored Your security measures Whether you access their data Breach commitments
WHAT TO PREPARE
A standard document answering all of it.
WHY
It shortens sales and avoids repeated work.
WHAT TO ESTABLISH INTERNALLY
When staff may access customer data How that access is logged What justification is required
WHY
Staff browsing customer data is a real and common failing.
WHAT TO BUILD
Logged, time-limited support access.
WHAT TO DOCUMENT
Retention of backups, logs and terminated accounts.
WHAT TO TELL CUSTOMERS
How long data persists after cancellation.
