Module 3 · Chapter 5

Data Protection: Controller, Processor, Sub-Processor

Payroll software holds every employee's pay, bank and sickness details. Who answers for that data, who may handle it, and who tells whom when it goes astray?

≈ 13 min read 8-question test

In this chapter

  • Who is the controller, the processor and the sub-processor of the employees' data
  • How Larchpay adds a sub-processor, and how an End Customer can say no
  • Who tells whom after a breach, and who answers an employee's request

5.1Data protection in one paragraph

The app holds the payroll details of every End Customer's employees: identity, bank, pay, tax, pension and absence, including sickness. The Agreement calls this End Customer Data. The UK's data protection law is the UK GDPR with the Data Protection Act 2018. Clause 7 of the Agreement fits that law to the deal: who answers for the data, and what each business must do.

Key point

Each End Customer controls its employees' data. Tressick and Larchpay handle it only on its instructions, and each answers to the business that instructs it.

Also in this chapter

  1. Three roles in one chain
  2. Using the data only on instructions
  3. Adding a sub-processor
  4. When personal data goes astray
  5. An employee asks for her data
  6. Your job

Preview

The rest of this chapter opens with a free account. Every edition is free to read until 31 January. Open a free account by the end of that day and keep every edition published by then, for good. Open it from the edition home →