Do an Online Data Processing Relationship Assessment

Identifying information

What’s your first name?*

(We need this to identify you)

What’s your surname?*

(We need this to identify you)

What’s the full legal name of your organisation?*

(E.g. Acme Corporation (Pty) Ltd.)

What does your organisation do? What’s their main activity?*

(We need this to understand your data processing)

What’s your role in the organisation?*

(We need this to understand your relationship with your organisation)

Contact information

What’s your email address?*

(We need this to link your answers to you)

What’s your phone number?*

(We need this to contact you, should we need to schedule a follow up call)

Relationship information

A data processing relationship typically involves one organisation (a processor) processing a data subject’s personal data on behalf of another organisation (a controller), and sometimes a subsequent organisation processing that personal data on behalf of the processing organisation (sub-processor). For example: Control Incorporated PLC (controller) outsources their payroll function to Processing Services (Pty) Ltd (processor), who in turn sub-contract part of the services to We-are-sub-processors LLC (sub-processor)

What role do you most often fulfil in your data processing relationships?*

controller: another organisation generally processes my data subject’s personal data on my organisation’s behalf - we are like ‘Control Incorporated PLC’ in the example above
processor: my organisation generally processes another organisation’s data subject’s personal data on behalf of that organisation - we are like ‘Processing Services (Pty) Ltd’ in the example above
sub-processor: my organisation generally processes data subject’s personal data on behalf of another organisation that in turn processes it on behalf of another organisation - we are like ‘We-are-sub-processors LLC’ in the example above

What role do other organisations in your data processing relationships most often fulfil?*

controller: my organisation or an intermediary organisation generally processes their data subject’s personal data on their organisation’s behalf - they are like ‘Control Incorporated PLC’ in the example above
processor: their organisation generally processes my or another organisation’s data subject’s personal data on behalf of that organisation - they are like ‘Processing Services (Pty) Ltd’ in the example above
sub-processor: their organisation generally processes data subject’s personal data on behalf of my or another organisation that in turn processes it on behalf of my or another organisation - they are like ‘We-are-sub-processors LLC’ in the example above

How would you describe the quality of your relationships with those other organisations generally?*

great: considerably above average, we get on like a house on fire and hardly have any problems
good: somewhat above average, we get on pretty well and don’t have many problems
average: we get on like most organisations and have the average number of problems
bad: somewhat below average, we don’t get on that well and have more problems than most
awful: considerably below average, we don’t get on at all and have lots of problems

Agreement information

How many DPAs or other agreements has your organisation signed to regulate your data processing agreements?*

(A 'DPA' is a data processing addendum or agreement)

Are you happy with what your organisation agreed to in those agreements?*

yes: I understand exactly what we agreed to and am happy to be bound by it
mostly: I understand most of what we agreed to and am optimistic about what we’re bound by
somewhat: I understand enough of what we agreed to and have no strong feelings to what we’re bound by
a little: I understand some of what we agreed to and am apprehensive about what we’re bound by
no: I have no idea what we agreed to and am unhappy about being bound to it

What issues are you finding problematic with your data processing relationships?*

Please specify any other issues that you're finding problematic

Processing information

What kind of personal data are you processing on your own behalf or on behalf of someone else?*

generic personal information: such as names, addresses, and contact numbers
sensitive personal information: such as account numbers, special personal information (beliefs, race or ethnicity, health or sex life, etc), children’s personal information

How much of it are you processing?*

a small amount: less than a hundred records
a medium amount: hundreds of records
a large amount: thousands of records
a massive amount: millions of records

Compliance information

What data protection laws are you interested in complying with when it comes to your data processing relationships?*

global data protection law: the majority of data protection rules that apply in jurisdictions throughout the world (particularly important for international businesses)
General Data Protection Regulation (GDPR): applies to anyone who processes personal data in the European Union
the Data Protection Act (DPA): applies to anyone who decides to process personal data in the United Kingdom or outside of it, if they do not use equipment in the United Kingdom merely for transit through the United Kingdom
the Protection of Personal Information Act (POPIA): applies to anyone who processes personal information in South Africa
other (please specify below)

Please specify any other data protection laws that you are interested in complying with when it comes to your data processing relationships

What kind of budget do you have to spend on your data processing relationships?*

minimal budget: I can only afford the basics when it comes to managing data processing relationships, but the basics are better than nothing
moderate budget: I can afford everything that is reasonably necessary for managing data processing relationships, but I need to get bang for my buck
massive budget: I can afford everything (but the kitchen sink) when it comes to managing data processing relationships, money is no object - I want to solve the problem as completely as possible

What kinds of personnel (including yourself) do you have available to work on your data processing relationships?*

incidental personnel - people who have time to spend on managing data processing relationships from time to time, but it’s not part of their main role
committed personnel: people who have various roles in our organisation, one of them being to manage data processing relationships
dedicated personnel: people whose sole role in our organisation is to manage data processing relationships

How many personnel (including yourself) would be managing data processing relationships on an incidental, committed or dedicated basis?*

Assistance questions

What other pain points or issues would you like help with when it comes to managing data processing relationships?

Have you previously had our help when it comes to data protection in any of the following ways:*

attended a Michalsons Data Protection Workshop
joined our Data Protection Compliance Programme
heard us speak at an event on data protection law
had us draft an opinion for you on a specific question about data protection law
read articles on our website about data protection law
other (please specify below)

Please specify any other way that you've previously had our help when it comes to data protection