Glossary

A · B · C · D · E · F · G · I · L · P · R · S · T · U

A

Absence reason

The reason a home manager may record when a care worker is off, such as “back injury”. It is data about health, so the law protects it more strictly. A leaked absence reason can hurt a care worker far more than a leaked shift time. Agreement, Schedule 1, paragraph 4 · Chapter 1 · see Special category data

Adequacy regulations

The government’s approval of a country, or of some recipients in it, as safe for data sent from the UK. They are the simplest route for sending data abroad, because the government has done the checking. The ones for the United States are known as the data bridge. Agreement, clause 7.2 · Chapter 7 · see Data bridge, Transfer risk assessment

Audit

A check of how the supplier handles the data, by the customer or an auditor it appoints. Corrandale first relies on Tennerby’s yearly security report. It may then audit once a year on 30 days’ notice, and again after a breach or an ICO request. Agreement, clause 11.3 · Chapter 4

B

Balancing test

The second step of legitimate interests: the person’s own interests and rights must not outweigh the use. A recognised legitimate interest needs no balancing test, because the law has already judged those uses worth it. Chapter 3 · see Legitimate interests, Recognised legitimate interest

Business Day

A working day: not a weekend, and not a public holiday in England. Tennerby must pass a request about Corrandale’s data to Corrandale within 2 working days. It must send the records Corrandale asks for within 5 working days. Agreement, clause 1.1, “Business Day” · Chapter 8 · see Subject access request

C

Controller

The party that decides why personal data is used, and its essentials: which data, whose, for how long and who may see it. Corrandale is the controller of its care workers’ data in the app. Tennerby controls only its own records, such as bills and support desk chats. Agreement, clause 2.1 · Chapter 1 · see Processor

Customer Personal Data

The Agreement’s name for the personal data Tennerby holds for Corrandale in the app: names, contact details, shifts, clock-ins and absence reasons. For all of it, Corrandale decides and Tennerby is the processor. Part of a rota inside a support request still counts. Agreement, clause 1.1, “Customer Personal Data” · Chapter 2 · see Controller, Processor

D

Data bridge

The everyday name for the UK’s adequacy regulations for the United States. It covers only US companies on the DPF List with the UK Extension, and only the kinds of data their entry covers. Tennerby’s notice wrongly said it covered care workers’ data. Record A, paragraph 3 · Chapter 7 · see Adequacy regulations, DPF List, UK Extension

Data cap

The £300,000 limit on what each side can owe the other under the Agreement, data claims included. It sits beside the Subscription Agreement’s £90,000 cap, not inside it. Repayments of compensation under clause 13.2 count towards it. Agreement, clause 13.1 · Chapter 4

Data processing agreement

The written contract the law requires between a controller and its processor. It says what the processor may do with the data, and what it must promise. Here it is the Data Processing Agreement that Corrandale and Tennerby signed in March 2027. Agreement, title page · Chapter 1 · see Controller, Processor

Data protection impact assessment

A written review of the risks that a use of data poses to the people in it. Corrandale does one for the app. Under clause 10.1, Tennerby gives it the information and help it reasonably needs. Agreement, clause 10.1 · Chapter 5 · see Security measures

Data subject

The living person the personal data is about. In this deal they are mostly Corrandale’s care workers, and also its home managers. Each of them may ask for a copy of their data. Agreement, clause 1.1, “Data Subject” · Chapter 8 · see Subject access request

Documented instructions

The written instructions a processor must follow. Under clause 3.2 they are the Agreement, Schedule 1 and the settings Corrandale chooses in the app. Anything more needs a named person in writing, so a manager’s request to the support desk cannot send data out of the app. Agreement, clause 3.2 · Chapter 3 · see Processor

DPF List

The Data Privacy Framework List: the US companies that have joined the framework. Each entry says which kinds of data the company may receive. Tallcourt’s entry has the UK Extension but covers “Non-HR Data” only, so the data bridge does not cover care workers’ details. Record B, paragraph 2 · Chapter 7 · see Data bridge, UK Extension

E

Exception

The third route for sending data abroad: a narrow ground for special cases. It does not suit a service that runs every day. Clause 7.2 leaves it out, so Tennerby may use only the other two routes. Chapter 7 · see Adequacy regulations, Transfer risk assessment

F

Flow-down

Passing a processor’s own duties down the chain, by contract, to each sub-processor it brings in. Clause 6.4 requires a written contract with the same duties as the Agreement. Tennerby still answers to Corrandale for each sub-processor. Agreement, clause 6.4 · Chapter 6 · see Sub-processor

G

General written authorisation

A controller’s standing permission for its processor to add new sub-processors, instead of approving each one. Corrandale gives it to Tennerby in clause 6.1. Each new company still needs 30 days’ notice first, and Corrandale may object. Agreement, clause 6.1 · Chapter 6 · see Sub-processor

I

Information notice

An order from the ICO to a controller or processor to answer its questions by a set date, under section 142 of the Data Protection Act 2018. A letter only asks, but a notice orders. Chapter 10 · see Penalty notice, Reprimand

L

Lawful basis

A reason the law accepts for using personal data, such as a contract or legitimate interests. The controller picks it, so Tennerby has none of its own for the rota data. In clause 3.1 Corrandale promises that it has one. Agreement, clause 3.1 · Chapter 3 · see Legitimate interests, Recognised legitimate interest

Legitimate interests

The widest lawful basis. The use must be necessary for a real interest of the controller or of others, and must pass the balancing test. Tennerby relies on it for its own statistics across customers, which identify no one. Chapter 3 · see Balancing test, Lawful basis

P

Penalty notice

The ICO’s order to pay a fine, under section 155 of the Data Protection Act 2018. For a processor’s security failings the most it can be is £8,700,000, or £2 for every £100 of worldwide turnover if higher. Chapter 10 · see Information notice, Reprimand

Personal data breach

A failure of security that leads to personal data being lost, destroyed, changed or seen by someone with no right to see it. It needs no hacker. A fault that showed care workers’ details to another customer’s managers was one. Agreement, clause 1.1, “Personal Data Breach” · Chapter 9

Processor

A party that holds and uses personal data only for a controller, on its documented instructions. Tennerby is Corrandale’s processor. A processor that starts to decide why data is used becomes a controller of that use. Agreement, clause 2.1 · Chapter 1 · see Controller, Sub-processor

R

Recognised legitimate interest

A newer lawful basis for a short list of uses that the law has already judged worth it, so there is no balancing test. The use must still be necessary. Corrandale relied on one to share a night’s rota, without absence reasons, when the council asked. Chapter 3 · see Balancing test, Lawful basis

Records of processing

A processor’s written account of what it does with each customer’s data, which Article 30(2) of the UK GDPR requires. Tennerby’s records list the kinds of processing, the sub-processors, any transfers out of the UK and the security measures in outline. Agreement, clause 5.3 · Chapter 5

Reprimand

A formal written finding by the ICO that the law was broken, with no fine. Chapter 10 · see Penalty notice

Return and deletion

What happens to the data when the contract ends. Corrandale may export its data for 30 days after the end, and then Tennerby deletes it. Backups are overwritten within 90 days, and Tennerby confirms the deletion in writing. Agreement, clause 12.2 · Chapter 4

S

Security measures

The steps a supplier takes to keep data safe at a level that fits the risk. Some are built into the software, such as encryption, and some are rules for people. Schedule 2 lists Tennerby’s eight, the least it must do. Agreement, Schedule 2 · Chapter 5 · see Records of processing

Special category data

Kinds of personal data that the law protects more strictly, such as data about health. Using it needs a lawful basis and also a condition under Article 9. In the app, absence reasons are special category data. Agreement, Schedule 1, paragraph 4 · Chapter 1 · see Absence reason

Stop the clock

To pause the month for answering a subject access request while the controller waits to hear which data the person wants. Corrandale asked the care worker which period she meant. The 7 days of waiting moved its deadline from 5 August to 12 August. Chapter 8 · see Subject access request

Subject access request

A person’s request for a copy of the personal data an organisation holds about them, and for how it is used. Their reason for asking does not matter. Tennerby passes a request about Corrandale’s data to Corrandale, and never answers that part itself. Agreement, clause 8.1 · Chapter 8 · see Business Day, Data subject, Stop the clock

Sub-processor

A company that a processor brings in to handle the data, such as Tennerby’s host. Each new one needs notice first, takes on the same duties by contract and goes on the list in Schedule 3. Agreement, clause 1.1, “Sub-processor” · Chapter 1 · see Flow-down, General written authorisation

T

Transfer risk assessment

A written check that data sent abroad under the approved clauses will still be well protected: not materially lower than in the UK. You wrote Tennerby’s for the Tallcourt texts, after Megan cut the data. It is reviewed every year. Record B · Chapter 7 · see UK Addendum

U

UK Addendum

An official form that adapts the EU standard contractual clauses for data sent from the UK. Tennerby and Tallcourt signed the clauses, module three, with the Addendum, because the data bridge did not cover care workers’ data. Agreement, Schedule 4, paragraph 1 · Chapter 7 · see Transfer risk assessment

UK Extension

The UK’s part of the EU-US Data Privacy Framework. A US company’s entry on the DPF List must include it before the data bridge covers data sent from the UK. Tallcourt’s entry did, but it covered “Non-HR Data” only. Record B, paragraph 2 · Chapter 7 · see Data bridge, DPF List