data processing agreement

SaaS Agreements – Data Protection – Restricted Transfers

04/07/2023 Irene Bodle

SaaS suppliers and SaaS customers currently have to comply with complicated rules and include onerous obligations in their SaaS agreements, data processing agreements and data privacy practices to lawfully make restricted transfers of personal data when providing SaaS services. Before making any restricted transfers of personal data, SaaS suppliers must ensure that the specific safeguards required under the UK GDPR and the EU GDPR are in place.

What is a Restricted Transfer

When a SaaS supplier sends or transmits personal data to an entity located in a country outside of the EEA which is not deemed “adequate” by the European Commission, this a restricted transfer.

Examples of restricted transfers that SaaS suppliers usually make are:

Hosting of SaaS customer personal data, for example in data centres operated by entities established outside of the EEA, for example: AWS, Microsoft;
Using technology services of suppliers located outside of the EEA, for example: Cloudflare, Google;
Using sub-processors located outside of the EEA to provide services to SaaS customers, for example: Zendesk, Sendgrid, Zoom;
Transferring or sharing access to personal data with group companies located outside of the EEA.

What is a Transfer Mechanism

SaaS suppliers and SaaS customers are required by European data protection authorities and the GDPR to use a recognised transfer mechanism in order to make their restricted transfers of personal data lawful.

In the past the following transfer mechanisms were recognized as providing “adequacy”:

Safe Harbor – covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems I decision of the European Court of Justice in 2015;
EU – US Privacy Shield – replaced Safe Harbor and covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems II decision of the European Court of Justice in 2020.

Following the Schrems II decision, the only transfer mechanisms now recognised by the EU as being “adequate” are:

Standard Contractual Clauses, (SCCs) – standard contractual clauses drafted by the European Commission for EU personal data and standard contractual clauses drafted by the UK Data Commissioner for UK personal data; and
Binding Corporate rules, (BCRs)

Additional Requirements

Following the Schrems II decision:

When using EU SCCs (or BCRs) as a transfer mechanism, EU SaaS suppliers and SaaS customers must also:

Implement additional safeguards when making restricted transfers; and
Carry out data transfer impacts assessments, (DTIAS).

When using UK SCCs (or BCRs) as a transfer mechanism, UK SaaS suppliers and SaaS customers must also:

Implement supplemental safeguards when making restricted transfers; and
Carry out data transfer assessments, (DTAs).

Also: note that in the UK there are 2 different types of UK SCCs that can be used:

International Data Transfer Agreement (IDTA)
UK Addendum to the EU SCCs (Addendum)

Google and Meta Decisions

However, in spite of compliance with the above obligations, Google has been declared by various EU data protection authorities, and more recently Meta, to be in breach of the GDPR for making unlawful restricted transfers of EU personal data. Meta has been fined €1.2bn (£1bn) and ordered to suspend all restricted transfers to the USA.

Meta is currently appealing this decision, and the fine awarded, and is continuing to make restricted transfers of personal data to the USA as the suspension only comes into effect in October 2023, by which time the new EU-US Data Privacy Framework (DPF) should have been granted “adequacy” by the European Commission, making the continued transfers to the USA lawful.

EU-US Data Privacy Framework – DPF

The DPF is the replacement transfer mechanism for the invalidated EU-US Privacy Shield to enable EU personal data to be transferred to the USA. The European Commission has indicated its intention to grant the DPF “adequacy” but like its predecessors, the DPF will probably be challenged by Mr Schrems and could again be declared invalid by the European Court of Justice at some point in the future.

Important note: The DPF can only be used by US businesses regulated by the Federal Trade Commission or the US Department of Transportation. Such businesses would need to self-certify compliance with the DPF.

UK – US Data Bridge

As the UK is no longer part of the EU following Brexit, it needs to agree its own transfer mechanism with the USA – that is also acceptable to the EU. The UK is referring to this new transfer mechanism as the UK-US Data Bridge and it appears to be an extension to the DPF specifically for the UK.

Summary

SaaS suppliers and SaaS customers need to closely watch developments over the coming months on the progress of these new proposed data transfer mechanisms in the US, EU and the UK.

However, even if the new transfer mechanisms are granted “adequacy” by the EU, they will only apply to transfers of personal data to the USA. SaaS suppliers and SaaS customers will still need to :

Have in place supplemental measures; and
Document data transfer impact assessments, (DTIAs) for any restricted transfers of personal data that rely upon SCCs that they make to other countries outside of the EEA, for example: Australia, Singapore etc.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – Does your DPA and Sub-Processor List need updating?

20/06/2023 Irene Bodle

Meta were fined 1.2 billion Euros for breaches of EU data protection law and for transferring personal data of EU users to the US despite, using standard contractual clauses, (SCCs), having in place supplemental measures and carrying out data transfer impact assessments, (DTIAs). Google has also been pursued in various EU member states for similar breaches.

In light of these decisions, SaaS suppliers should review their own data protection practices and documentation to ensure that they are up to date and comply with the current rules.

Use of the correct SCCs

New EU SCCs

Since the 27^th of December 2022 the new EU SCCs must be used for all transfers of EU personal data to a third country. Any SaaS agreements that still include the old EU SCCs must be updated to include the new EU SCCs.

New UK SCCs

All SaaS agreements concluded on or before the 21st of September 2022 must use the new UK SCCs.

SaaS suppliers and SaaS customers can only continue to use the old EU SCCs in existing SaaS agreements until the 21st of March 2024 provided that the processing operations that are the subject matter of the agreement remain unchanged.

Supplemental Measures

In addition to using the correct, and up to date SCCs, SaaS suppliers must carry out due diligence on any sub-processors they plan to use to process personal data, where the sub-processors rely upon SCCs to transfer personal data outside of the EEA. Details of the supplemental measures used must be included in the sub-processor list.

The only supplemental measures that are compliant with the European Data Protection Board, (EDPB) guidelines are:

Encryption of data at rest and in transit; and
Storage of encryption keys within the EEA.

Data Impact Transfer Assessments

Following the Schrems II decision, the court made clear that SaaS suppliers and SaaS customers must carry out and document data transfer impact assessments when using SCCs as a transfer mechanism for restricted transfers.

SaaS suppliers should check their Article 30 GDPR data mapping document to identify which sub-processors rely upon SCCs, then they must;

Carry out a Schrems II data transfer impact assessment, for each transfer from the EU;
Carry out an ICO data transfer assessment for each transfer from the UK, (DTA) using the ICO tool or using an EU DTIA.

Summary

When reviewing compliance with the above rules SaaS suppliers and SaaS customers should not just check their SaaS agreements with customers. They will also need to review existing group data transfer agreements and existing agreements and DPAs with all third parties, i.e. suppliers, resellers, partners and sub-contractors.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – New EU Standard Contractual Clauses

19/07/2021 Irene Bodle

The new EU Standard Contractual Clauses (new SCCs) must now be used by all SaaS suppliers and SaaS customers who transfer personal data from the EU to countries outside the EU/EEA (third countries) as the old SCCs (old SCCs) were repealed on the 27th of September 2021. Below is a summary of the changes and measures that SaaS suppliers and SaaS customers need to take to adapt and implement the new SCCs.

What are EU Standard Contractual Clauses

EU standard contractual clauses are standard data processing agreements that have been approved by the EU Commission as providing adequate protection for the transfer of personal data from the EEA to a third country – known as a restricted transfer. Until the 27th of September 2021 there were two sets of standard contractual clauses: (i) for transfers of personal data between data controllers; and (ii) for transfers between a data controller and a data processor.

New SCCs must be used where EU personal data is transferred from:

A data controller (SaaS customer) to a data processor (SaaS supplier) located outside of the EEA; or
A SaaS supplier (data processor) transfes EU personal data to a sub-processor located outside of the EEA;

The SaaS supplier will need to enter into the new SCCs with the SaaS customer or SaaS sub-processor, as applicable.

When must the new SCCs be used?

From the 27^th of September 2021 all new data processing agreements with customers and suppliers (including inter-company agreements) must use the new SCCs. SaaS suppliers and SaaS customers can continue using the old SCCs for existing agreements until the 27th of December 2022. On or before the 27^th of December 2022 all old SCCs must be replaced with the new SCCs.

How are the new SCCs different?

The new SCCs cover 4 different types of transfers:

controller to controller;
controller to processor;
processor to processor;
processor to controller.

SaaS suppliers and SaaS customers must adapt and customise the 4 modules as required for each customer, supplier or inter-company data transfer, as applicable.

No separate DPA required

The new SCCs include all of the provisions that must be included in a written data processing agreement under Article 28 of the GDPR. This means that the new SCCs can be used without the need for any additional DPA. However, SaaS suppliers and SaaS customers should still have an overarching data transfer agreement that the new SCCs form a part of, in appropriate cases, as the new SCCs have very onerous provisions that should only apply to transfers of EU personal data.

Obligations of the Parties

Each of the 4 modules sets out the different data protection obligations of the parties which will need to be customised for each applicable module, or deleted if a module does not apply.

Security Measures

Specific technical and organisational measures (TOMs) must be described in Annex II of the new SCCS, clearly indicating which specific measures apply to each transfer.

Competent Supervisory Authority

The data importer agrees to accept the authority of the competent data protection authority named in Annex I of the new SCCs, respond to its enquiries, comply with the measures adopted by the data protection authority and submit to audits by the data protection authority.

The data protection authority of the data exporter, not the data importer will be the competent supervisory authority.

Where the data exporter is not located in the EU, but is subject to the GDPR the supervisory authority will be that of:

the country in which the data exporter’s EU representative is established; or
the EU country in which the data subjects whose personal data is transferred are located, where no EU representative is required under the GDPR.

Local Law Assessment and Documentation – Schrems II

The data exporter and data importer must warrant that they have completed a data transfer assessment (DTA) of the local laws in the third country to which EU personal data will be transferred, where SCCs (of BCRs) are relied upon as the lawful basis for the transfer. They must also warrant that they have no reason to believe that such laws would prevent the importer from complying with their obligations under the new SCCs.

The parties must document this DTA (known as a “Schrems II assessment”) and make the DTA available on request, to a data protection supervisory authority.

Access by Public Authorities

Data importers must comply with the contractual obligations set out in the new SCCs if they receive a binding request from a public authority for disclosure of personal data. This includes notifying the data exporter, documenting responses and requests, providing periodic reporting to the data exporter, and challenging requests, if the data importer determines that any access request is unlawful.

Third Party Beneficiaries

Data subjects can make direct claims and complaints against the data importer for breaches of the new SCCs.

Liability

The data exporter and data importer are jointly and severally liable for breaches of the new SCCs. Each party is also liable to the other and data subjects for breaches of the new SCCs.

Onward Transfers

These are only permitted where the third party receiving the personal data signs the new SCCs or is established in a country that is “adequate”, such as the UK.

What about the UK

The new SCCs cannot be used for UK personal data. The old SCCs adapted by the UK Data Commissioner(ICO) must be used in relation to all UK personal data.

Implementing the New SCCs

In order to implement the new SCCs SaaS suppliers and SaaS customers need to:

carry out a data mapping exercise to identify all personal data transfers;
carry out and document a Schrems II data transfer assessment for each transfer using SCCs or BCRs;
review and amend their technical and organisational measures used for protecting personal data transferred to third countries;
identify and review all existing contracts and template agreements that involve the transfer of EU personal data to a third country;
amend all exisitng DPAs to incoporate the new SCCs;
adapt and customise the new SCCs and their Annexes for transfers to and from customers, suppliers and inter-group companies;
use the new SCCs for all new contracts entered in from 27^th of September 2021;
replace the old SCCS with the new SCCS in all existing contracts by the 27^th of December 2022.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – GDPR – Data Processing Agreement

22/06/2018 Irene Bodle

Since the General Data Protection Regulation (GDPR) came into force on the 25th of May 2018, SaaS suppliers and SaaS customers are legally obliged to include a written data processing agreement (DPA) in the terms of their SaaS agreements. The DPA usually forms a schedule to the SaaS agreement and must include the specific and detailed mandatory obligations set out in the GDPR. SaaS suppliers should use their own DPA and resist any attempt by a SaaS customer to have them sign up to the SaaS customer’s DPA for the following reasons.

Mandatory Terms

Although the GDPR clearly sets out that the DPA should include all data processor and data controller obligations. However, many DPAs provided by SaaS customers do not include:

All mandatory obligations required under the GDPR; and
Any data controller (SaaS customer) obligations at all.

Additional Obligations

Many SaaS customer DPAs seek to impose additional or far more onerous obligations on the part of SaaS suppliers in the terms of their own DPA than are required under the GDPR. For example, a SaaS supplier, (the data processor) has to report a data breach without undue delay but often SaaS customers, (the data controller) try to impose an obligation to report immediately or within 24 hours.

Liabilities and Indemnities

SaaS customers often add unlimited liabilities and indemnities to the DPA that only apply to the SaaS supplier, retaining their own limited liability for any breaches. Any limitations on liability included in the SaaS agreement should also apply to breaches of the DPA, particularly in light of the high fines (20 million Euros or 4% of annual worldwide turnover) that can be imposed for a breach of the GDPR.

Security Policy

It is mandatory to set out the technical and administrative security provisions that the SaaS supplier has in place to protect personal data. As the SaaS customer cannot know what security provisions the SaaS supplier and its sub-contractors i.e. the data centre have in place, it is entirely unrealistic for the SaaS customer to dictate what these should be, as they will not reflect the actual practices adopted by the SaaS supplier and its sub-contractors. The SaaS supplier should therefore always provide these details.

Applicable Data Protection Law

The DPA should refer to the GDPR and for UK SaaS suppliers, the Data Protection Act 2018. References to the EU Data Protection Directive are now obsolete (unless they refer to amendments or replacement legislation) and should be updated.

Providing Assistance

Many SaaS customer DPAs contain onerous and wide ranging obligations on SaaS suppliers to assist with audits, DPIAs, data subject requests and return and deletion of data which go far beyond the SaaS supplier’s obligations set out in the GDPR. These clauses should be carefully reviewed and amended to reflect the mandatory obligations of the SaaS supplier under the GDPR and should include provisions for a SaaS supplier to be paid for providing assistance.

Subcontractors

Any exclusion on the use of subcontractors should be removed from the DPA – as all SaaS suppliers use subcontractors, due to the nature of cloud computing – all SaaS suppliers use a data centre. The provisions on how and when subprocessors can be used and in which jurisdictions, should be carefully drafted to ensure that these permit the actual practices of the SaaS supplier in providing the SaaS services. EU standard contractual clauses must be used where any UK or EU personal data is transferred outside of the EEA.

Controller or Processor DPA

To avoid the above issues, SaaS suppliers should:

Draft their own GDPR compliant DPAs;
Send existing SaaS customers their DPA for inclusion in the existing SaaS agreement without delay;
Include their own DPA in their current SaaS agreements as a schedule for new SaaS customers.

Where a SaaS supplier agrees to use a SaaS customer’s DPA the SaaS supplier should have the terms of the DPA checked by a lawyer who will be able to:

Identify which obligations are not mandatory under the GDPR;
Which obligations of either party are missing;
Adapt the terms to protect the interests of the SaaS supplier in compliance with the requirements of the GDPR.

Help

IIrene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – What SaaS Suppliers need to know about the GDPR

23/05/2017 Irene Bodle

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change existing data protection laws in all 28 EU member states. The GDPR will place direct obligations on SaaS suppliers (data processors) in relation to data processing activities. In addition SaaS customers (data controllers), their clients (data subjects) and local data protection authorities will be able to enforce breaches of the new rules directly against SaaS suppliers.

SaaS suppliers need to amend the provisions of their existing SaaS agreements in order to comply with the upcoming changes in data protection law.

Written Data Processing Agreement

SaaS suppliers will need to include the following minimum terms in a written data processing agreement with all SaaS customers:

The duration, nature and purpose of the data processing;
The types of data being processed;
The obligations and rights of the customer.

The written data processing agreement must state that:

Personal data will only be processed in accordance with documented instructions from the SaaS customer;
The SaaS supplier will assist the SaaS customer in complying with its own obligations as a data controller;
The SaaS supplier is obliged to inform the SaaS customer if it believes an instruction to give personal data to the SaaS customer breaches the GDPR or any other EU or Member State law.

Record Keeping

Unless one of the exceptions applies, the main one being that the SaaS supplier has less than 250 employees, SaaS suppliers must keep records of all categories of processing activities that they carry out.

The following details must be recorded:

Information about the SaaS customer and any other data processors;
Names of relevant data protection officers (DPOs);
The categories of data processing carried out;
Any transfers to third countries; and
The general technical, organisational and security measures used by the SaaS supplier.

If requested by a supervisory authority, SaaS suppliers must provide such records.

Subcontracting

SaaS suppliers will need to obtain prior written consent to the subcontracting of any data processing activities: for example the using a third party hosting centre such as AWS or Microsoft Azure. Although SaaS suppliers can include a general consent to subcontracting in the provisions of their SaaS agreeents, SaaS suppliers will still be obliged to inform SaaS customers before adding or replacing any sub-processors in order to give customers time to object to a change.

Breach Notification

SaaS suppliers will be required to notify SaaS customers of any breach of their obligations, without undue delay, after becoming aware of the breach.

Data Protection Officers

SaaS suppliers will be obliged to appoint a data protection officer (DPO) in some specific circumstances: for example where the SaaS supplier is processing special data (sensitive data) or if required to do so under a Member State law.

The contact details of any DPO appointed must be published and communicated to the applicable supervisory authority.

Deletion or Return of Data

SaaS suppliers must allow SaaS customers to choose between deletion or return of all personal data on termination or expiry of the SaaS agreement (unless applicable mandatory law requires storage). SaaS customers will be entitled to check compliance with this requirement.

Transfers outside the EEA

Although SaaS suppliers are required to follow a SaaS customer’s instructions with regard to data processing, SaaS suppliers may only transfer personal data outside of the EEA if the SaaS supplier or SaaS customer has provided appropriate safeguards: for example by using of EU model clauses or Binding Corporate Rules (BCRs).

Fines and Compensation

Data subjects will be able to take action against SaaS suppliers directly and claim damages for the SaaS supplier’s breach of any obligations under the GDPR; or
SaaS suppliers will be potentially liable to both the SaaS customer and data subjects for the same breach.

In addition data protection authorities will be able to fine SaaS suppliers up to 4% of annual global turnover for some breaches.

Preparing for Change

SaaS suppliers need to review the terms of their existing SaaS agreements and their internal procedures to ensure that they comply with the new rules on the use of subcontractors, data security requirements, appointment of DPOs and having in place appropriate organisational and technical measures.

SaaS suppliers should ensure that existing and future agreements with their sub-processors impose the same data processing obligations on all subcontractors, as the SaaS supplier will be liable to the SaaS customer and data subjects for any breaches of the new rules caused by any subcontractors.

SaaS suppliers should ensure that their insurance cover and indemnities and limitations on liability contained in existing SaaS agreements relating to use of personal data are sufficient to cover the higher levels of fines and direct claims for damages by data subjects.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience dealing with SaaS, cloud computing matters and IT law issues. If you require assistance with any SaaS agreements, cloud computing matters or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Terms and Conditions – Data Processing Agreement

15/03/2017 Irene Bodle

UK SaaS suppliers currently have limited obligations to SaaS customers when processing personal data as part of their SaaS services. Under the General Data Protection Regulation (GDPR) many new data processing obligations are imposed on SaaS suppliers. In particular, the obligation for SaaS suppliers to enter into a written data processing agreement with SaaS customers and subcontractors.

GDPR applies to UK SaaS Suppliers despite Brexit

Regardless of when and how Brexit takes place, the GDPR will apply to SaaS suppliers located within the UK if:

They offer goods or services to SaaS customers located within the EU (i.e. in any of the remaining 27 EU Member States); or
They monitor the behaviour of EU data subjects;

Even though UK SaaS suppliers will no longer be located within the EU themselves after a Brexit.

GDPR applies to non-EU SaaS Suppliers

The GDPR automatically applies to all SaaS suppliers located outside of the EU i.e. in the USA, if:

They offer goods or services to SaaS customers located within the EU; or
They monitor the behaviour of EU data subjects;

Even though the SaaS supplier is not located within the EU.

Written Data Processing Agreement

Under the GDPR SaaS suppliers and SaaS customers must include detailed data processing obligations in a written data processing agreement. This can form part of the SaaS Agreement or be a separate schedule or agreement.

SaaS Suppliers should be aware that they need to enter into written data processing agreements not just with all SaaS customers, but also with all entities or persons who process personal data on their behalf, such as:

All subcontractors i.e. data centres, penetration testing providers;
All subsidiaries i.e. providing customer support, software maintenance and support.

Fines for Breach

Data subjects can claim damages directly from SaaS suppliers who breach:

Any obligations under the GDPR; or
Any lawful instructions of a SaaS customer.

In addition data protection authorities can fine SaaS suppliers or SaaS customers up to 4% of annual global turnover or 20m Euros (whichever is higher) for breaches of the GDPR.

Preparing for Change

To ensure compliance with the new obligations placed on SaaS suppliers (data processors) under the GDPR, SaaS suppliers should taking the following steps:

Review existing data protection policies and procedures for compliance with the GDPR;
Adapt existing privacy, security and data breach policies to comply with the new rules before the 25th of May 2018;
Create a written data processing agreement which reflects the above polices and which is compliant with the GDPR;
Review existing SaaS agreements to check limitations on liabilities and indemnities for data protection breaches;
Identify any subcontractors and subsidiaries who process personal data;
Audit compliance of subcontractors and subsidiaries with new policies and procedures; and
Add written data processing agreements to all existing agreements with SaaS customers, subcontractors and subsidiaries.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience in dealing with SaaS, cloud computing and IT law issues. If you require assistance with any SaaS agreements, cloud computing concerns or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – New obligations for SaaS Customers

30/01/2017 Irene Bodle

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change UK data protection law. The GDPR will place further more onerous obligations on SaaS customers (data controllers) in relation to all data processing. SaaS customers need to amend the terms of their existing SaaS agreements and privacy policies and implement the changes into internal policies and procedures in order to comply with the upcoming changes in UK data protection law.

Data Subject Rights

Data subjects will have more extensive rights to access, rectify and object to the storage and processing of their personal data. New rights to delete, restrict processing, rights in relation to profiling and the right to data portability will be introduced. SaaS customers will also be required to provide a lot more information to data subjects about processing activities than in the past i.e. in their privacy policies.

Fines

Data subjects will be able to take direct action against SaaS customers and claim damages resulting from breaches by SaaS customers of their obligations under the GDPR.

In addition data protection authorities will be able to fine SaaS customers up to 4% of annual global turnover for some breaches.

Preparing for the Changes

SaaS customers should review the terms of their existing SaaS agreements and privacy policies to ensure that they comply with the new rules before the GDPR comes into force.

SaaS customers should ensure that existing and future agreements with any subcontractors (data processors) impose the same data processing obligations on further subcontractors (sub-processors), as the SaaS customer could be liable to the data subject for any breaches of the new rules caused by any subcontractors.

SaaS customers should ensure their insurance cover and the terms of their SaaS agreement with all SaaS suppliers include indemnities and limitations on liability relating to personal data that are sufficient to cover the higher level of fines and claims made directly by data subjects.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – New Obligations for SaaS Suppliers

23/01/2017 Irene Bodle

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change existing UK data protection laws. The GDPR will place direct obligations on SaaS suppliers (data processors) in relation to data processing activities. In addition SaaS customers (data controllers) and their clients (data subjects) will be able to enforce breaches of the new rules directly against SaaS suppliers. SaaS suppliers need to amend the terms of their existing SaaS agreements in order to comply with the upcoming changes in data protection law.

Written Data Processing Terms

SaaS suppliers will need to include the following minimum terms in a written data processing agreement with all SaaS customers:

The duration, nature and purpose of the data processing;
The types of data being processed;
The obligations and rights of the SaaS customer.

The written data processing terms must state that:

Personal data will only processed in accordance with documented instructions from the SaaS customer;
The SaaS supplier will assist the SaaS customer in complying with its own obligations as a data controller;
The SaaS supplier is obliged to inform the SaaS customer if it believes an instruction to give personal data to the SaaS customer breaches the GDPR or any other EU or Member State law.

Record Keeping

The following details must be recorded:

Information about the SaaS customer and any other data processors;
Names of relevant data protection officers (DPOs);
The categories of data processing carried out;
Any transfers to third countries; and
The general technical and organisational security measures used by the SaaS supplier.

If requested by a supervisory authority, SaaS suppliers must provide such records.

Subcontracting

SaaS suppliers will need to obtain prior written consent to the subcontracting of any data processing activities. Although SaaS suppliers can include a general consent to subcontracting in their SaaS agreement, SaaS suppliers will still be obliged to inform SaaS customers before adding or replacing any sub-processors in order to give SaaS customers time to object to a change.

Breach Notification

SaaS suppliers will be required to notify SaaS customers of any breach of their obligations, without undue delay, after becoming aware of the breach.

Data Protection Officers

The contact details of any DPO appointed must be published and communicated to the applicable supervisory authority.

Deletion or Return of Data

Transfers outside the EEA

Although SaaS suppliers are required to follow a SaaS customer’s instructions with regard to data processing, SaaS suppliers may only transfer personal data outside of the EEA if the SaaS supplier or SaaS customer has provided appropriate safeguards. For example by the use of EU model clauses or Binding Corporate Rules (BCRs).

Fines and Compensation

Data subjects will be able to take action against SaaS suppliers directly and claim damages for the SaaS supplier’s breach of:

Any obligations under the GDPR; or
Any lawful instructions from the SaaS customer.

SaaS suppliers will be potentially liable to both the SaaS customer and data subjects for the same breach.

In addition data protection authorities will be able to fine SaaS suppliers up to 4% of annual global turnover for some breaches.

Preparing for Changes

SaaS suppliers should ensure that their insurance cover and SaaS agreement indemnities and limitations on liability relating to use or personal data are sufficient to cover the higher levels of fines and direct claims for damages by data subjects.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: