GDPR IT Service Provider

GDPR for IT Service Providers

Whether it is Software-as-a-Service (SaaS), cloud solutions, or apps, IT service providers often implement the IT and software infrastructure for other companies. In doing so, they frequently process personal data on behalf of these companies. This falls under the General Data Protection Regulation (GDPR). German supervisory authorities interpret the processing of personal data by IT service providers extremely broadly. Processing is considered to take place as soon as access to personal data (such as employee or customer data) cannot be ruled out during testing or maintenance. In practice, this access can rarely be ruled out.

Especially during support and maintenance activities, the IT service provider regularly acts on behalf of the other company and under its instructions. For such processing on behalf of a controller, the conclusion of a data processing agreement (DPA) in accordance with Art. 28 GDPR is legally mandatory.

However, there is much more that you as an IT service provider must consider regarding data protection. Maintenance contracts also play a major role here.

External Data Protection Officer for IT Service Providers

For IT service providers in particular, an external data protection officeris highly recommended, as they handle a large volume of personal data from a wide variety of companies. Protecting this data requires specific contractual arrangements, the implementation of special technical and organizational measures, and much more. To be well-prepared, an external data protection officer can help you keep track of data protection management within your company. An external data protection officer provides support and advice, reports their assessment of risks associated with handling personal data to management, and helps avoid costly data protection violations. Furthermore, companies are legally required to work only with data processors that are adequately set up in terms of data protection law. A data protection officer is therefore a competitive factor that should not be underestimated.

Legal Basis: GDPR for IT Service Providers – What do IT service providers need to look out for regarding data protection under the GDPR?

Data protection for an external service provider generally involves different factors than internal data protection. This applies in principle to all external providers. As an IT service provider, you must pay particular attention to the following points under the GDPR:

• Privacy Policy: Does the privacy policy on your website reflect the latest legal requirements? Use the Proliance privacy policy template as a guide.
• Risk Analysis: Before you implement a project, you must (with the help of your data protection officer) conduct a risk analysis of the data application.
• Data Processing Agreement (DPA): As an IT service provider, you are often a data processor within the meaning of the GDPR (Art. 4 No. 8 GDPR). This makes it necessary to conclude a data processing agreement. This agreement regulates the handling of the personal data you process. Important: As a data processor, you are accountable to the controller!
• Record of Processing Activities: As an IT service provider, you process personal data. These processing activities must be recorded in a record of processing activities (ROPA).
• Documentation and Accountability Obligations: To fulfill your accountability obligations toward your client as well as the legislator, you must strictly adhere to the documentation and accountability requirements of the GDPR. This documentation must be presented in the event of an audit by the supervisory authority.
• Technical and organizational measures: The GDPR mandates backups, data encryption, data pseudonymization, anonymization, and much more to protect the rights of data subjects. In this context, data subjects are all individuals whose data is being processed. Your clients are required to work only with companies that can guarantee an appropriate level of data protection through technical and organizational security measures. Identifying and implementing suitable measures is essential for IT service providers—a data protection officer is an invaluable resource here.
• Data security: Data security vs. data protection—the difference lies in the details, but both must be ensured and implemented by IT service providers.
• Non-disclosure agreements for service providers: As a service provider, you should be particularly alert when highly sensitive or innovative data is being processed. Check whether you need a non-disclosure agreement, especially if you employ subcontractors!
• Certifications: Article 28 of the GDPR requires "sufficient guarantees" from the data processor. This is an indeterminate legal term, but you can satisfy it through specific service certifications, such as ISO 27001.
• Remote maintenance: Remote maintenance is a sensitive issue, as it gives you, the IT service provider, access to and control over client computers and data. You should train your employeesso that they can brief clients on screen sharing before starting any remote maintenance.
• Working from home: Do you support a company where working from home is the norm? Naturally, all the rules mentioned above apply here—from the data processing agreement to encryption, you must implement all requirements and ensure data security as stipulated in your contract.

Our services at a glance

With our data protection software, Proliance 360, we help you implement your company's data protection systematically, step by step. This is how you reliably implement the GDPR for IT service providers!

The steps provided by the Proliance 360 software on the path to data protection compliance include:

1. Assess: Data protection inventory, data protection audit
2. Analyze: Risk analysis, data protection action plan, data protection compliance
3. Document: Website privacy policy, data protection documentation, technical and organizational measures, creation of a record of processing activities
4. Improve: Data protection impact assessment, employee training, management of data subject requests, data processing agreement, data breach, expert support, external data protection officer, data protection consulting, data protection management