UK GDPR and SAFEcic customers;
As our original data protection systems were already more robust than required, few SAFEcic clients will notice any change at all. Please follow this link for our Privacy Policy
How does the UK GDPR define SAFEcic's role?
When an organisation purchases SAFEcic products or services, some personal data will need to be shared between that organisation and SAFEcic. The UK GDPR defines BOTH the purchaser and SAFEcic as “Joint Data Controllers”.*
As Joint Data Controllers, it is the responsibility of each Data Controller’s organisation to ensure its’ own compliance with UK GDPR and the Data Protection Act 2018. A public commitment to compliance such as The SAFEcic Privacy Policy is seen as sufficient for each organisation to show due diligence in ensuring the other is compliant. **
Written Contract? Not required with SAFEcic.
This page on the ICO website states that a written contract is needed in some circumstances:
“Whenever a controller uses a processor it needs to have a written contract in place.”
Having read this, some of our clients are asking; “Does my organisation need a written contract with SAFEcic?”
The answer to this question is no, because SAFEcic is always defined as a “Data Controller” rather than a “Data Processor”.
What is the difference between a "Data Controller" and a "Data Processor"?
a) A “Data Controller” has responsibility for how any data is processed and stored (including selecting any software used), how long that data is kept and how the data should be disposed of when that period expires.
b) A “Data Processor” has none of these responsibilities. Therefore a written contract is required to guarantee that the “Data Processor” behaves entirely in accordance with the instructions of the “Data Controller”.***
Audits etc;
During some of SAFEcic's activities (e.g. audits), SAFEcic personnel will view individual records but will not directly record, or actually be in possession of any data or documents at any time. Viewing of the information is always controlled by one of the client's authorised personnel . Any records that are referred to in reports and/or are retained by SAFEcic are created manually (not through copy/paste) and anonymised. Where individual files are reviewed and it is necessary that the client be able to track information, those records are pseudonymised so that only the client has the ability to identify the records. This complies with UK GDPR and ICO recommendations and means that no data sharing or confidentiality agreement is required.
*See Article 26 of Regulation (EU) 2016/679 “Joint Controllers” (Replaces Article 26 of the EU GDPR).
