In brief

Data protection laws in the UK seek to ensure information about living individuals (within the definition of ‘Personal data’) is used fairly and responsibly. To help ensure that, UK data protection law imposes a large number of obligations on those ‘processing’ personal data (and on controllers of such processing). ‘Processing’ is broadly defined to include doing most things with data, including storing, deleting, collecting, disclosing or using it.

One of the key protections under UK data protection law is the set of obligations placed on ‘controllers’ (usually meaning those that decide the purposes and means of processing) and ‘processors’ (those that process personal data on behalf of a controller further to the controller’s instructions). Among other things, UK data protection law usually requires controllers and processors to put in place contracts containing certain minimum provisions and ensure any processor(s) they engage are suitable. In an Outsourcing arrangement, the customer will often act as controller and the supplier as its processor.

This Practice Note introduces the Requirements under UK data protection law in the context of an outsourcing