Processes with sensitive data: can they be outsourced?

Key takeaways

Outsourcing processes with sensitive data is lawful under UK GDPR if you have a processor contract, a valid transfer mechanism for any data leaving the UK, and controls that match the risk. Special category data, such as health information, needs extra care. Sensitivity is a reason to control a process tightly, not automatically a reason to keep it.

• You stay the controller; the provider is your processor.
• An Article 28 contract is required for any processor.
• Transfers outside the UK need a mechanism such as the IDTA.
• Special category data needs extra safeguards.

What makes a process's data sensitive?

Under UK GDPR, special category data includes health, ethnicity, religion, trade union membership, biometrics and sex life or orientation. Criminal offence data has its own rules. Beyond the legal categories, financial details, salaries and commercially confidential information are sensitive in practice. List which of these each process touches before scoring it.

• Which business processes should you outsource?
• A business process register: map every process once

What does UK GDPR require when you outsource?

You remain the controller and must use processors that give sufficient guarantees about security. The contract must cover the points in Article 28, including acting only on your instructions, confidentiality and helping you meet data subject rights. If data goes to a country without UK adequacy, such as Sri Lanka, you need a transfer mechanism such as the International Data Transfer Agreement and a transfer risk assessment.

• Data processing agreements for outsourcing
• GDPR and offshore outsourcing

What controls should a sensitive process have?

Give access only to the data each step needs, use named accounts with multi-factor authentication, keep data inside your systems rather than copied to the provider's, and log who accessed what. Review access monthly. For special category data, consider masking fields the provider does not need to see.

• Least-privilege access for each step.
• Named accounts with multi-factor authentication.
• Data kept in your systems, not exported.
• Monthly access review.
• Masking for fields not needed.

• System access for outsourced teams: fast but safe
• Data security with an outsourced team

When should sensitivity keep a process in-house?

Keep it when you cannot meet the transfer rules, when a sector regulator or customer contract forbids offshore access, or when the provider cannot show the controls above. Some NHS-linked work, for example, requires the Data Security and Protection Toolkit. Splitting the process so only non-sensitive stages move is often a workable middle path.

• Regulated processes: outsource the work, keep the duty
• Outsource, split, fix or keep: four process verdicts

What does this look like in practice?

A pattern we see: a process looks too sensitive to move until someone checks which steps actually need the sensitive fields. Often only one step does, and the rest can move with that data masked.

• See client work
• BPO Solutions for UK businesses

Sensitive process checklist

Confirm these before any sensitive process moves.

• List the data categories the process uses.
• Sign an Article 28 processor contract.
• Put a transfer mechanism in place if data leaves the UK.
• Limit access to what each step needs.
• Record the decision in your data protection records.

• Process criticality: rate the damage if it fails
• Who is responsible for data protection in a small firm?

Next step

Tell us which sensitive process you are considering and what data it uses. We will tell you which steps could move, which should stay, and what the contract and controls would need to cover.