Outsourcing the Processing of Personal Information - Guidance

The Information Commissioner’s Office offers guidance on how to comply with the Data Protection Act 1998 (DPA) when you outsource the processing of personal information, such as your payroll function or customer mailing information.

If you use an outside organisation to process personal information on your behalf, you remain responsible for the processing and will be liable for any breaches of the DPA. The Act requires that you take the appropriate technical and organisational measures to protect the information being processed whether this takes place in-house or whether someone else does it for you. In order to decide what measures are needed, the following should be taken into account:

• what sort of information is being processed?
• what harm might result from its misuse?
• what technology is available to ensure the appropriate level of security?
• what would be the cost of providing this level of security?

The guidance stresses that if you employ another organisation to process personal information for you, you must select one that you believe will carry out the work in a secure manner. Ongoing checks should be made to ensure that this is the case. Wherever the organisation is based, you must have a written contract with them. This should state that the personal data can only be used and disclosed in line with your instructions and that appropriate security measures must be taken.

If you are using an organisation based outside the European Economic Area, make sure the contract is enforceable in that country.

In summary, the good practice recommendations if you want to outsource the processing of personal data to an outside organisation are:

• select a reputable organisation offering suitable guarantees as to their ability to ensure the security of the data;
• make sure the contract is enforceable;
• make sure the appropriate security measures are in place;
• make sure that the organisation makes appropriate checks on its staff;
• audit the organisation regularly to make sure it is up to standard;
• require the organisation to report any breaches of security or other problems; and
• put in place procedures that allow you to act appropriately if a problem is reported.

The guidance can be found on the Information Commissioner's website.

See also our guidance on the eight data protection principles.