Stakeholders & GDPR Training

What the training consists of

1. 

   1. Data controllers

   2:00

   A data controller is the organisation that decides why and how personal data is processed. The first lesson explains this role and shows that almost every company is one, for example for its customer or employee data.

2. 

   2. Data processors

   2:11

   The second lesson explains the role of data processor, a supplier that processes personal data for a company that has outsourced the task, such as hosting, and follows its instructions. It also covers the contract between them, a data processing agreement.

3. 

   3. Joint controllers and recipients

   1:40

   Recipients, such as an insurance company, receive personal data and decide for themselves how to use it. The last lesson covers them, and joint controllers, who decide together why and how data is processed.

Why it matters

An organisation is responsible for all personal data under its control, including data that a data processor handles on its behalf. Knowing which role it has with each partner or supplier is important for compliance with the GDPR and for protecting people’s rights.

What your colleagues learn

• Each organisation in a data exchange has a role. A clinic, its software provider and the insurance company it shares patient data with each have a role under the GDPR, and each role comes with its own responsibilities.
• One company can hold two roles at once. A software provider is a data processor for a clinic’s patient data and a data controller for its own employees’ data, so it has to meet the requirements of both.
• Sharing data with another controller is not outsourcing. A clinic can only send an insurance company the data a claim needs, not tell it how to handle claims, so the insurer has its own responsibilities for that data.
• Working together on data calls for clear agreements. Two clinics offering a joint treatment share responsibility for the data, so they need clear agreements on managing it, securing it and meeting people’s rights.