Outsourcing Compliance Hub
Every processor relationship, data sharing arrangement, and third-party integration creates GDPR obligations. We help you manage them systematically — so your vendor contracts protect you, not expose you.
Why Vendor Compliance Is a Controller's Responsibility
As a controller, you remain responsible for what happens to personal data even after you share it with a third party. A processor breach or a missing DPA can mean an ICO enforcement action against you.
Processor Obligations
UK GDPR Article 28 requires a written contract with every processor. The contract must include mandatory terms — data subject rights, sub-processors, deletion, security, and audit. Missing or inadequate DPAs are the most common finding in ICO investigations.
Joint Controllers
Where two or more organisations jointly determine the purposes and means of processing, you are joint controllers and need a written arrangement setting out your respective responsibilities. Often missed where marketing partners or analytics platforms are involved.
International Transfers
Sending personal data to processors outside the UK — including US cloud providers and SaaS tools — requires a valid transfer mechanism: UK Adequacy Regulation, UK SCCs, or Binding Corporate Rules.
The Accountability Principle
ICO guidance requires you to maintain a record of all processor relationships and evidence due diligence. Demonstrating accountability requires more than signing a DPA — you need to know what your processors are actually doing with the data.
Outsourcing Hub Services
From one-off contract reviews to a complete third-party risk programme.
Vendor Mapping
Building a register of all third parties that receive personal data — processors, joint controllers, and recipients — with their role, data categories, and transfer status documented.
DPA Review and Drafting
Reviewing existing data processing agreements against Article 28 requirements and drafting compliant DPAs where you are the controller instructing a processor, or the processor contracting with sub-processors.
Joint Controller Arrangements
Identifying joint controller relationships — particularly with analytics providers, marketing platforms, and research partners — and drafting the Article 26 arrangements that GDPR requires.
Transfer Impact Assessments
Assessing international transfers to countries without adequacy decisions — particularly US-based cloud and SaaS providers — and confirming the transfer mechanism in place is valid under current ICO guidance.
Vendor Due Diligence
Reviewing processor security documentation, sub-processor registers, and breach notification procedures before you sign — so you only contract with processors who meet your GDPR obligations.
Ongoing Third-Party Risk Programme
A retainer-based service that maintains your vendor register, reviews new contracts, monitors for processor changes, and keeps your documentation current as your supplier base changes.
What You Receive
Clear documentation your team can act on and evidence you can show the ICO.
| Deliverable | Purpose | Who It's For |
|---|---|---|
| Vendor Register | A record of all processors, joint controllers, and recipients with key data | DPO, Legal, Compliance |
| DPA Templates & Reviewed Agreements | Article 28-compliant contracts ready to sign | Legal, Procurement |
| Joint Controller Arrangement | Article 26 written arrangement for joint processing relationships | Legal, Partners |
| Transfer Impact Assessment | Documented assessment of each international transfer and its mechanism | DPO, Legal |
| Due Diligence Report | Assessment of a specific processor's security and GDPR posture | Procurement, Leadership |
| Risk Register Update | Third-party risks recorded in your central data protection risk register | DPO, Board |
Tom S.
Medical Practice
"Improved control over sensitive medical data"
"Practical guidance on access controls and data protection. Helped define structured access policies and introduced tokenisation for patient identifiers used in analytics."
Sarah S.
Retail, Enterprise
"Reliable partner for telecom data protection"
"Quickly understood telecom data complexity; helped classify sensitive datasets and apply protection measures for subscriber, usage, and billing data."
Pauliina H.
Entertainment, Enterprise
"Effective support for securing customer data"
"Identified where sensitive data lived and applied tokenization and anonymization strategies in a complex telecom environment."
Jordan R.
Computer Networking
"Practical approach to safeguarding e commerce"
"Helped protect PII, payment data, and order histories with tokenization and anonymization; advised on GDPR compliance for international operations."
Charmaine S.
Int. Trade & Development
"Systematic Approach Enhances Data Security"
"Methodical approach through discovery, planning, and implementation; implemented Microsoft Purview for a scalable compliance framework."
Kateryna H.
IT and Services
"Practical approach to protecting sensitive Data"
"Structured data discovery and classification combining technical analysis with finance data privacy expertise; strong masking and tokenization policies."
Snow D.
Market Research
"Practical expertise for telecom information"
"Introduced tokenization and controlled access strategies for subscriber data while still supporting analytics and reporting."
Laura H.
Hospital & Health Care
"Valuable expertise in healthcare protection"
"Strong expertise in healthcare data security; introduced anonymization techniques for safely using patient data in research and reporting."
Know exactly where your vendor risk sits.
Tell us how many processors you work with and we will scope a review that gives you a clear picture of your third-party risk — and what to fix first.
Review My Vendor Contracts