Checklist Appointing a Data Processor

Summary

This is a practical checklist published by the Jersey Office of the Information Commissioner to help organisations that act as data controllers when engaging a third party supplier to process personal data on their behalf. It is not a legally binding instrument itself but sets out the steps and contractual terms expected to comply with data protection law when appointing a data processor.

• Before appointing: Confirm controller status, understand the processor's role, identify data categories and purpose, check security measures, ask about sub-processors, and plan compliance review arrangements.
• Contract terms: Put in place a written contract covering subject matter, duration, nature and purpose of processing, data types, and processor obligations such as acting only on documented instructions, confidentiality, security measures, sub-processor conditions, return or deletion of data after the service ends, and audit cooperation.
• Ongoing monitoring: Continuously monitor the processor's compliance with instructions and security standards, support for data subject rights and breach notification, oversight of any sub-processors, secure data return or deletion at service end, and record keeping to demonstrate compliance.
• Risk and compliance review: Assess whether processing is high risk, confirm legal basis and transparency obligations are addressed, update the register of processing activities, and periodically review the contract and arrangements as circumstances change.

The checklist functions as guidance rather than a set of standalone legal duties, but each item reflects obligations that arise under Jersey's data protection law for controllers using processors.

Key obligations

• Controllers must put in place a written contract or legal act with any data processor setting out the subject matter, duration, nature and purpose of processing, and the types of personal data and data subjects involved
• Controllers must ensure the processor contract requires processing only on documented instructions, confidentiality obligations for authorised persons, appropriate technical and organisational security measures, conditions on sub-processor use, return or deletion of data at the end of the service, and cooperation with audits and inspections
• Controllers must monitor the processor's ongoing compliance with instructions, security measures, and support for data subject rights and breach notification duties
• Controllers must maintain oversight of any sub-processors engaged by the processor
• Controllers must verify secure return or deletion of data at the end of the processing service and ensure no residual copies remain unless retention is legally required
• Controllers must keep records documenting how the processor appointment and monitoring has been managed
• Controllers must update their register of processing activities to reflect the processor relationship
• Controllers must periodically review and update the contract and arrangements with the processor

Applies to

data controllers, organisations using third party data processors, data processors