Controllers, processors, suppliers, and contracts

The ICO describes a controller as the organisation deciding the purposes and means of processing personal data. A processor handles personal data on behalf of the controller and follows the controller's documented instructions. In care homes, the provider will often be the controller for resident and staff records, but each arrangement must be assessed on its facts.

Managers should test supplier labels rather than accept them at face value. Systems and services used in care - for example care planning, payroll, rotas, CCTV, shredding, cloud storage, eMAR, call-handling, consultancy, or AI documentation tools - may claim to be "GDPR compliant", but that label does not tell you who decides what data is used, why it is used, where it is stored, how long it is retained, or who is liable if something goes wrong.

Supplier questions before approval

• Role: are we controller, joint controller, processor, or using a processor?
• Purpose: exactly why is the data being processed, and does this match privacy information and contracts?
• Data: what categories of resident, staff, visitor, health, safeguarding, payroll, or CCTV data are involved?
• Access: which supplier staff can access data and for what support or maintenance reason?
• Sub-processors: are hosting, support, analytics, transcription, backups, or AI functions provided by others?
• Location: where is the data stored or accessed from, and are international transfer safeguards needed?
• Security: what technical and organisational measures, audit trails, encryption, MFA, backups, and incident notification arrangements exist?
• Exit: how will data be returned, deleted, migrated, or retained when the contract ends?

Contracts are not optional decoration

The ICO requires controllers to use processors who can provide sufficient guarantees and to place the controller-processor relationship in a contract or other binding legal act. The contract should specify the processing details and include terms on documented instructions, confidentiality, security, sub-processors, support for data subject rights, breach assistance, return or deletion of data, and audits or inspections.

Review contracts before any personal data is shared. Keep a supplier register, note review dates, record sub-processor details, and identify which contracts involve resident or staff personal data.

Contract register fields

Supplier governance starts before personal data is uploaded. A promise that a system is "secure" is not a substitute for role clarity, contract terms, DPIA screening, and exit planning.