simisj

Basically, I am checking whether we have contracts between ourselves as Data Controllers and third parties we use (Data Processors). Every company I have contacted so far to see if a formal agreement/contract was put in place has told me that when we agreed to the T&Cs when we first set up with them is the contract between ourselves. Looking at them in more detail they do mention in the T&Cs about how they process our data, how long they keep it for etc. Obviously it is more a case that we are agreeing to their terms rather than them agreeing to ours. I highly doubt I will be able to get 1) our school staff to ensure they have individual contracts to anyone who processes our data and 2) have large national companies agree to contracts we provide when they have their own in place.

Hi, very late to the party here but as I have only just been made the DPO at my school and I don't think my predecessor did much with GDPR. Can you just confirm (because I believe it to be the case) if our staff agree to the Terms and Conditions of Privacy Notices and it has the info about how data is processed etc we have entered into a contract albeit not on our terms?