GDPR Data subprocessor questions

[mjk]

please could anybody help with these questions:

 

1) If a school has a contract with a company who shares data with a third party, does the school need to report that they share data to the third party ?

An example would be that the school contracts it's MIS data to Capita, and that Capita store their data on Microsoft and Amazon's servers and then subcontract the support to another company. When we report to students and parents, do we say that we share data with all of the companies - or just Capita. (this is a hypothetical scenario - I've no idea where Capita host their data).

 

2) If a school subcontracts to a third party who does not hold data, do we need to report to students and parents that we share data with them. An example might be an engineer who would remote in and have access to data but would not store or copy the data.

[djrscally]

1) No I don't think so. In the example you gave I don't think you're "sharing" data at all, as that term implies passing it off to another data controller. Instead, you're just giving data to your processor to process on your behalf. You don't need to list all your processor's sub-processors in the privacy notices.

 

2) We're lumping people like that into "various independent specialists such as consultants, specialist teachers etc"