Data controller duties you cannot outsource

Key takeaways

Data controller responsibilities stay with your business even when a provider handles the data. As controller, you decide why and how personal data is used, choose lawful bases, tell people what you do, answer their rights requests and must be able to show compliance. Providers act as processors on your instructions under a written contract.

• The controller decides purposes and means; the processor follows.
• You must be able to show compliance, not just claim it.
• Rights requests are yours to answer, usually within one month.
• Every processor needs a written contract.

Why can't controller duties be outsourced?

Because UK GDPR places accountability on the controller. A processor can be liable for its own failures, but the controller remains responsible for choosing processors that give sufficient guarantees and for how the data is used overall. The ICO will look first to the controller.

• Which business processes should you never outsource?
• You can outsource the work, never the accountability

Which decisions stay with the controller?

The decisions that define the processing.

• What data to collect and why.
• The lawful basis for each use.
• How long to keep it.
• Who it is shared with.
• Whether to report a breach.
• How to answer rights requests.

• Data breaches: who decides whether to report?
• Customer data: always own the list

What can a processor do for you?

Handle the data on your instructions: run the service, store records securely, help you answer subject access requests, notify you of breaches without undue delay and delete or return data at the end. A good processor also prompts you when instructions are unclear.

• GDPR and offshore outsourcing: what UK firms must do
• BPO data security: protecting data with outsourced teams

What evidence should you keep?

A record of processing, signed processor contracts, privacy notices, rights request logs, breach logs and evidence that you checked each processor's security. Most UK businesses that process personal data must also pay the ICO data protection fee unless exempt.

• Outsourced DPO: hand over the role, keep the duty

What does this look like in practice?

A pattern we see: a business assumes its outsourced provider 'does GDPR'. When a customer asks for their data, nobody knows who should respond. A simple log and a named internal owner settle that before it matters.

• See client work
• BPO Solutions for UK businesses

Data controller checklist

• Name an internal owner for data protection.
• Keep a record of processing.
• Sign contracts with every processor.
• Log rights requests and breaches.
• Check the ICO fee is paid.

• A digital asset register: know what you own online
• Data breaches: who decides whether to report?

Next step

List every provider that touches personal data for you, and check you have a signed processor contract for each.