Sharing customer data with a partner: what is your company responsible for?

Before accepting responsibility for customer data in a partnership agreement, establish which data decisions each business actually makes. Under the EU General Data Protection Regulation (GDPR), those decisions determine whether you act independently, jointly or on another business’s instructions. The role can change between activities within the same partnership.

For an application that sends enquiries to independent service providers, this becomes a practical contracting question: can your team deal with a deletion request after data has entered the partner’s systems? A clause making you “responsible for data protection” needs to say what work and costs that involves. This article concerns processing subject to the EU GDPR.

One account, two services

Imagine Jacob, Tim and Celina run an application through which users send enquiries to a service provider of their choice. Their company operates the account and routes the enquiry. The partner agrees its own service scope and price with the customer, then delivers that service.

Celina reviews the draft agreement. The partner wants their company to handle all customer issues and accept responsibility for every use of data within the collaboration. Jacob suggests keeping a single contact address so customers do not have to find the right business. Tim checks what happens after an enquiry is sent: some data enters the partner’s system, which their company does not control.

They need to separate the activities before accepting that clause. A single contact address can make support easier. It does not settle who makes the data decisions or who should bear the cost of a mistake.

Controller or processor: who makes the decisions?

A controller determines the purposes and essential means of processing: why the data is needed and how its use is organised. Here, account management, routing an enquiry and delivering the partner’s service each need a separate review.

A processor handles personal data on a controller’s behalf and under its instructions. A business hosting the company’s database may fill that role. It can choose some technical implementation details without gaining permission to use the data for its own purposes. The European Data Protection Board (EDPB) small business guide explains the distinction.

Where the partner independently decides the purposes and essential means of using data for its own service, it may be a separate controller. A data processing agreement, often called a DPA, is not the right arrangement for that activity simply because both businesses see the customer’s name and email address.

Celina and Tim therefore need practical answers. Who chooses what information to collect, who receives it and how long it is kept? Can the partner decide on further uses? Compare those answers with the actual product. Calling a business a processor in an annex cannot settle a different reality.

When does a shared offer involve joint control?

Joint controllers jointly determine the purposes and essential means of particular processing. Complementary decisions can also establish joint control where they are necessary for that processing and have a tangible effect on its purposes and means. The parties need not have equal influence or both directly access the data.

Suppose the company and partner design an enquiry form together, choosing what to collect and how to use it for a joint customer acquisition campaign. Collection and transfer then need a joint-control assessment. That does not determine the role for the partner’s later, independent service billing. Conversely, shared infrastructure or a mutual commercial benefit alone does not establish joint control. These boundaries are explained in EDPB Guidelines 07/2020, paragraphs 53 to 74.

Avoid assigning one role to the whole relationship. The same businesses may be joint controllers at one stage, separate controllers at another, and have a controller-processor relationship for a further activity.

A service complaint and a deletion request need different decisions

Jacob returns to the shared inbox. Tim suggests testing it with two messages: “the partner delivered a poor service” and “delete my data”.

The first concerns performance of the customer contract. The second requires an assessment of GDPR rights. One email may contain both. Agree who identifies the issue, who decides what to do, who provides information and who replies. The team receiving the message may lack the information or authority to resolve all of it.

For joint control, an individual can exercise GDPR rights against either joint controller regardless of the internal allocation of tasks (Article 26(3)). A processor must assist the controller with requests under Article 28(3)(e). An agreed contact route cannot become a reason to send people back and forth.

Record the handover channel, the time allowed for supplying information and how completion is confirmed. A data breach needs a separate escalation route. The timing is covered in our article on a breach at a SaaS provider.

Choose the arrangement after mapping the data flow

Start with a short description of what data travels from whom to whom, and for what purpose. Add who makes decisions at each stage. Use that description to choose the appropriate arrangements:

• Processing on another business’s behalf requires the terms set out in GDPR Article 28, including instructions, security and assistance with individuals’ rights.
• Joint control requires a transparent allocation of responsibilities under Article 26. The essence of that arrangement must be available to the individuals concerned.
• Separate controllers should document the sharing arrangements. Each needs a lawful basis for its activities and must meet the applicable transparency duties. A contract between businesses does not itself authorise unrestricted data use.

The legal foundations are GDPR Articles 4, 5, 6, 13, 14, 26 and 28. These arrangements serve different relationships and cannot be substituted for one another.

Check the documents against each other too. If the commercial contract describes an independent partner but the privacy notice presents it solely as following your instructions, customers receive conflicting information. A GDPR and InfoSec review needs to connect those documents with the actual data flow.

Can the contract protect you from a partner’s mistake?

A contract can address costs between the businesses, including assistance with claims, evidence preservation and reimbursement of justified expenses. It cannot remove an affected individual’s rights under the GDPR.

GDPR Article 82(1) to (5) links compensation to damage resulting from an infringement. A controller is liable for damage caused by processing that infringes the GDPR. A processor is liable where it breaches obligations specifically directed to processors or acts outside or contrary to the controller’s lawful instructions. A party can be exempt if it proves it is in no way responsible for the event causing the damage.

If several parties are involved in the same processing and are responsible under those conditions, an individual can recover the full compensation from one of them. A party paying in full can then seek the appropriate share from the others responsible. This does not make every participant liable for every mistake anywhere in the project.

Before signing, Celina needs agreement on what their company can actually do with the access it has, and how the businesses will cooperate and allocate costs when an issue also involves the partner. A useful readiness check is to follow one customer enquiry through the entire process, then follow a deletion request relating to it. A stage where nobody knows who must act needs an operational fix as well as contractual attention.

Terms and legal references explained

Data controller

The business or other body that determines why personal data is processed and the essential means of doing so. The role relates to particular processing activities; it does not mean the person administering an IT system.

Data processor

A separate body processing personal data on a controller's behalf and under its instructions. It may choose some technical implementation details. Access to data alone does not make a business a processor.

Joint controllers

Two or more bodies jointly determining the purposes and essential means of particular processing. Their influence need not be equal. Allocating tasks between them does not prevent individuals from exercising their rights against either joint controller for that processing.