A data processor is an outside organisation that handles personal data on your behalf, such as a payroll provider, a cloud host or a call centre. The register records what each one does for you, where it processes the data, and the agreement that governs the work.
Who can do this
An owner, editor or contributor of your workspace can add and change suppliers. A viewer can see them.
Find the register
Open Records & controls → Data processors.
The figures at the top are Suppliers, No agreement recorded, Lapsed and Review not recorded. If a supplier is handling customer data with no agreement recorded, a warning names it.
The rail links to Data transfers, Security controls, Impact assessments and Sub-processors.
Add a supplier
Press Add a supplier. There are four steps.
- Location: the Contracting entity name and Country of establishment, the Headquarters country, and each place they handle the data. For each location choose the Country, the Processing type (for example Processed there or Stored there), the Evidence source and the Date checked. Leave unknown details blank.
- Supplier details: the Supplier legal name, a Service description, the Data and system access they have, and the Business criticality: Low, Moderate, High or Critical.
- Agreements: what is on file. Choose Nothing in writing yet, Only their standard terms or Written data protection terms. If terms exist, record the Acceptance method, Agreement version and Acceptance date.
- Review: check the summary and create the record.
The Processing duties checklist in step 3 lists eight duties to look for while you read the agreement, such as They tell you before adding sub-processors and They delete or return it at the end. Your ticks are not saved. It is a reading aid, not a record of what the agreement says.
Locations outside Nigeria
For every processing country outside Nigeria, Asiri creates a draft transfer record linked to the supplier, in the same step. Each transfer stays a draft until its safeguard is signed. Open it from the confirmation, or from Records & controls → Data transfers.
On the supplier
The supplier page has the sections What they handle, The contract, Controls they own, Security reviews and History.
The contract separates what is expected of any processor from what a reading of this agreement actually found. Until somebody has read the agreement clause by clause, nothing there is evidenced. Standard terms on file are not the same as terms that cover the eight duties.
- Press Record a change when the agreement changes. Say What is on file, When it changed and How the terms were accepted.
- Under Security reviews, record a review with its owner, due date, decision and the evidence it relied on.
- Press Stop using this supplier when the relationship ends, and give When you stopped using them and Why you stopped. The supplier leaves the current register and stays in its history.
Common questions
"Is accepting their online terms enough?" It records that terms exist. Whether those terms carry the processing duties is a separate question that someone has to answer by reading them.
"Why did a transfer appear?" You recorded a processing location outside Nigeria. The transfer needs a signed safeguard before it leaves draft.
"Does ticking the checklist record the duties?" No. The ticks are not saved.