Module 1 · Chapter 1
Data Protection Work for a Software Supplier
A software company that holds its customers’ staff data works for them, under a written contract. This chapter shows who decides about the data, what each side wants, and how one year runs.
In this chapter
- Who decides about staff data, who only holds it, and why a contract sits between them
- Why care homes use a rota app, and what the homes and the supplier each want
- Who is who, and how one year runs from the first draft to the regulator’s letter
1.1Who decides about staff data, and who holds it
A business that hands its staff data to a software supplier stays in charge of that data. The business is the controller: it decides why and how the data is used. The supplier is its processor: it holds and uses the data only for the business. The law makes them sign a written contract, a data processing agreement, that says what the processor may do.
This workbook follows one such contract, the Data Processing Agreement (the Agreement), through its first year. You are a trainee in the technology team at Ormsley Dennacott, a law firm. You act for Tennerby, a small software company that holds the staff data of Corrandale, a group of care homes.
Key point
Corrandale decides about the data, Tennerby holds it, and the Agreement says who may do what.
1.2Why care homes plan their rotas in an app
A care home must have enough trained care workers on every shift, day and night. Planning that on paper is slow, and one sick call can undo a week’s plan. A rota app helps in three ways:
- It shows at a glance whether each shift has enough trained care workers.
- It copes with the changes that come every day, such as sickness and late swaps.
- Care workers swap shifts on their phones, and the home sees each swap at once.
The app also records when each care worker clocks in, and texts each one their shifts. Every one of those features runs on data about care workers. The care workers are not the supplier’s customers, yet the supplier holds their names, phone numbers and working hours. That is why the contract matters.
1.3A rota app and its largest customer
Tennerby’s app plans the rotas of 400 care homes, and all the data stays in the UK. The Agreement calls the app “the Service”.
Corrandale runs care homes with 2,500 staff. It is Tennerby’s largest customer. Corrandale pays for the app under the Subscription Agreement, the main contract between the two. The fee is simple: 2,500 staff at £3 a month is £7,500 a month.
The two companies sign the Agreement in March 2027. It deals only with the data. If the two contracts disagree about the data, the Agreement wins.
The rules are in the UK GDPR and the Data Protection Act 2018. The Data (Use and Access) Act 2025 changed both. The UK GDPR is the main data protection law. The ICO, the data protection regulator, enforces the rules.
These are the people in the year:
| Who’s who | What they do |
|---|---|
| Tennerby Software Limited (“Tennerby”) | A small software company in Leicester whose app runs the rotas of 400 care homes. Your firm’s client, and the processor. |
| Megan Strovell | Tennerby’s chief technology officer. She runs its data protection. |
| Corrandale Care Limited (“Corrandale”) | A group of care homes across the East Midlands, and Tennerby’s largest customer. The controller. |
| Ormsley Dennacott LLP | Your firm, a law firm in Leicester. |
| Bronwen Strellby | A senior associate in data protection at Ormsley Dennacott. She supervises you. |
| You | A trainee in Ormsley Dennacott’s technology team. |
Tennerby does not run everything itself. One company hosts the app for it, and another sends the texts. A company that a processor brings in to handle the data is a sub-processor. The Agreement lists both, and says how to add another.
Schedule 1 lists the data the app holds:
Types of personal data: names, contact details, job roles, shifts, clock-in times and, where a manager records one, the reason for an absence, which may be data concerning health.Read in the Agreement →
When a care worker is off, a home manager may record an absence reason, such as “back injury”. That is data about health, so it is special category data. The law protects it more strictly than names and shifts. A leaked absence reason can hurt a care worker far more than a leaked shift time.
1.4What each side wants from the Agreement
Corrandale is responsible to its care workers for their data. The law lets it use only a processor that gives “sufficient guarantees” that the data will be safe. So Corrandale wants:
- notice before any new company touches the data
- the right to check how the data is kept safe
- fast news if anything goes wrong
- the data kept in the UK
- money back if Tennerby’s fault causes it a loss
Tennerby sells one app to 400 homes on one standard form. So it wants:
- the same terms for every customer, because it cannot keep 400 different promises
- a limit on what it must pay if something goes wrong
Both still want the deal. Corrandale needs the app, and Tennerby needs its largest customer.
Tennerby needs to get the data right too. Care homes buy the app only if they trust it with their care workers’ data. The ICO can also question a processor, not only the controller. The year runs like this:
| When (2027) | What happens |
|---|---|
| February | Talks. Corrandale’s solicitors send their own draft, and the two sides negotiate. |
| March | Signing. The Agreement starts, and this is month 1 of the year. |
| May | A new sub-processor. Tennerby tells Corrandale that a new company will send the shift texts. |
| July | A request. A care worker asks Tennerby for everything it holds about her. |
| September | A breach. A fault in a new release shows Corrandale’s data to the wrong people. |
| October to December | The ICO’s letter. The regulator asks Tennerby how the fault happened. |
1.5Your job
Bronwen asks you to start a data map of the app. For each kind of data, record:
- What it is, using the list in Schedule 1.
- Whose it is: care workers or home managers.
- Who decides about it: Corrandale or Tennerby.
- Where it is kept, and by which company.
- Who can see it: home managers, Tennerby’s staff or another company.
Mark the absence reasons as health data. Keep the map up to date. Every question in the year starts from the map: a new company, a request or a breach.
Key takeaways
- Corrandale is the controller: it decides why and how its care workers’ data is used.
- Tennerby is the processor: it holds and uses the data only for Corrandale.
- The Agreement is the written contract the law requires between them.
- Absence reasons are health data, so the law protects them more strictly.
- Corrandale wants control and fast news. Tennerby wants one standard form and a limit.