No organisation is an island
How you manage data processing relationships matters, because no organisation is an island entirely of themselves. Every organisation is a piece of the archipelago, a part of the island chain.
A link in a chain
Your organisations is probably a link in a chain, beginning with a sole or joint controller at the top, generally passing down to a processor and often ending with a sub-processor (or even additional subsequent processors) at the bottom. There are strict data protection laws (including the GDPR in the EU, the DPA in the UK and POPIA in South Africa) that regulate how that chain operates and require each link to enter into written data processing agreements (DPAs) with their neighbours.
You are likely part of an interconnected processing pipeline, where you have processing relationships with other organisations up or down the line. Most organisations give personal data to, receive it from or share it with other organisations – but, few understand what data protection law requires of those transactions.
Have empathy
You should therefore have empathy for everyone else in your processing ecosystem, because you’re all in the same boat.
You should be able to imagine what it would be like to be in their position in the chain by trying to:
- understand their thoughts – e.g. What does your sole controller think are important terms to put in a data processing agreement with you as a processor? Why do they think that?
- be aware of their attitudes – e.g. What’s your joint controller’s attitude towards sharing the responsibilities for complying with data protection law where you’re also a joint controller and you’re both responsible? Why do they have that attitude?
- be sensitive to their feelings – e.g. How does your processor feel when you send them an onerous data processing agreement as their controller? Why do they feel that way?
- and share in their experiences – e.g. How does your sub-processor experience their processing relationship with you, wherever you are in the chain (as a prior sub-processor, processor or controller)? Why do they experience it that way?
Empathy with each other in data processing relationships is better for data subjects – and, that’s who data protection laws care about protecting.
Have empathy for each other. Do it for the data subjects, because you care about them. If you don’t care about them, the law will make you with fines and penalties.
Who should join?
What are the outcomes?
About the facilitators
David is the primary facilitator for our Data Processing Relationship Programme. He believes that less is more when it comes to the law and works as an information lawyer because he enjoys simplifying complex ideas into practical insights.
He facilitates interactive programmes, drafts beautiful documents, and writes succinct opinions so that corporates, SMEs, and entrepreneurs alike can use the law in an accessible and meaningful way to accelerate their business.
He has more than seven years experience in information law and a special interest in how it applies internationally, including in cutting edge jurisdictions such as India, Ireland and Southeast Asia – which reflects in the global perspective of his work.
Why Michalsons?
Programme outline
How long is the programme?
FAQ
Testimonials
The workshop demystified a substantial amount of issues and did what it was supposed to “simplify” the law – Much appreciated!
Excellent presenter! Very knowledgable and read his audience needs well.