Data Protection Across the Triangle
Three parties, two contracts and one set of personal data, with the roles rarely written down anywhere.
Direction of the work
Whether the work is any good
Equipment and systems
Whatever the agreement did not list
YoursThe provider'sCrosses the twoNeither contract
Four matters, and no share: what any one agreement covers differs by agreement. One crosses both, and the handoff is where these arrangements fail. Everything the fee did not buy stayed where it was.
Where each data obligation actually landed in one buyer's arrangement, once somebody mapped it
Payroll and employment records about the person
The provider'sLands as: The provider decides what to collect and how long to keep it, as employer, under local law
What you can do: Ask for their retention schedule rather than assuming yours applies to it
Work records you create about the person, from accounts to performance notes
YoursLands as: Your own controller obligations, exactly as for anybody else working in your systems
What you can do: Include them in your own records of processing; the commonest gap is that nobody did
Telling the person who holds what about them
Crosses the twoLands as: Two controllers, two privacy notices, and a person who receives one of them or neither
What you can do: Confirm the provider issues theirs at onboarding, and issue your own for what you hold
A subject access request from the person
Crosses the twoLands as: Each party owes an answer for its own data, and neither can answer for the other
What you can do: Agree the routing before one arrives, because the clock starts on the day it does
Transfers to a provider's local partner in another country
The provider'sLands as: A further processor in a jurisdiction you did not choose and may not have assessed
What you can do: Ask who the partner is and whether the transfer arrangements are documented
A breach at the provider affecting your people
Crosses the twoLands as: Notification duties on both sides, running on statutory clocks that do not wait
What you can do: Fix the notification period in the agreement in hours, not in reasonable endeavours
Six obligations, and the three that cross are the three nobody had assigned. One buyer's own mapping of its own arrangement; who is controller for what differs by jurisdiction and by the facts.
Three parties hold personal data about one person, under two contracts, and the question of who is responsible for which part is rarely written down anywhere.
The control boundary in “Data Protection Across the Triangle” should be written before workforce technology is deployed. Organisations assessing open the detailed product page for how to calculate idle time should define which data is collected, who can view it, how long it remains and how access is removed when a worker, manager or provider changes.
Mapping it takes an afternoon and is the kind of work that only ever happens before it is needed or long after.
The ISO 45001 occupational-safety overview provides an external reference for the issue raised in “Data Protection Across the Triangle”. It is most useful when the team records which principles apply to this arrangement and which require local advice.
Who holds what
The provider holds employment data: contract, payroll, tax, leave, sickness, bank details. You hold work data: accounts, email, documents, calendars, whatever your systems record about how somebody works.
Two distinct sets, two distinct purposes, two distinct controllers in most analyses:
| Data | Held by | Purpose |
|---|---|---|
| Contract, payroll, tax, bank details | The provider | Employing somebody |
| Leave and sickness records | The provider | Statutory administration |
| Accounts, mail, documents, calendars | You | Running the work |
| Notes on how the work is going | You | Managing the work |
Drawing that boundary on one page, with examples, is the first thing to do. Almost every later argument about responsibility is really an argument about which side of the line something fell on.
The role question
For the employment data, the provider is almost certainly a controller in its own right rather than your processor, because it decides what it must collect as employer.
For your work data, you are the controller and the provider has no part in it. Agreements that describe the whole relationship as controller-to-processor are frequently wrong, and the error matters when something goes wrong.
Your own records of processing
Somebody working in your systems, on your work, produces personal data you are responsible for. Their employment status does not change that.
The commonest gap is simply that nobody added this population to the record of processing, because they are not in the HR system and therefore not on anybody's list.
Privacy notices
The provider should issue one as employer. You should issue one for what you hold as a client, exactly as you would for a contractor or a visitor.
Most buyers do not, and the person receives either one notice or none. Writing yours takes an hour and covers everybody in the same position.
Subject access requests
The person can ask either party. Each answers for its own data, and neither can answer for the other, which means a request to the wrong party wastes part of a statutory clock.
Agree the routing in advance and tell the person who to ask for what. The time to do this is not the day a request arrives.
Transfers
Data goes from you to the provider, from the provider to a local partner, and sometimes onward to a payroll bureau. Each hop may cross a border.
Ask for the chain. A provider that cannot describe it quickly has not thought about it, which is itself the answer to your question.
Special categories
Sickness information, in particular. The provider will hold medical certificates; you should not, and should not ask.
Where a manager receives something sensitive directly from the person, the right move is to route it to the provider and not retain a copy. Say that to managers explicitly.
Breach notification
Statutory clocks are short and do not pause for a supplier relationship. A breach at the provider affecting your people is something you may have to notify.
Fix a notification period in the agreement, measured in hours. Vague undertakings to notify promptly are the clause everybody accepts and nobody can use.
Retention
The provider keeps employment records for whatever period local law requires, which may be several years after the person has gone.
Your own retention of work data is yours to decide and should be the same as for anybody else. The two schedules have no reason to match and frequently surprise people who assume they do.
Monitoring
Anything you do to monitor work — logging, device management, activity data — applies to this person as it does to everybody, and in several countries carries employer-side obligations the provider must discharge.
Tell the provider what you monitor. They may need to inform the person or consult a works council, and they cannot do either without knowing.
At the end
Your work data is yours to delete or retain under your own schedule. The provider's employment data stays with them.
Ask what happens to anything of yours in their systems, and ask for confirmation rather than assurance.
The person should also be told what is kept and by whom. They will otherwise assume that leaving removes everything, which is true of almost nothing.
What no agreement resolves
Whether a regulator in that country would take the same view of the roles as the contract does. These structures are newer than the law applied to them, analyses differ between jurisdictions, and a carefully drafted allocation of roles is an argument rather than a decision.
The useful posture is to behave as though you are responsible for what you actually control, to document the reasoning, and not to rely on a clause to move an obligation that follows the facts. That is also, as it happens, the posture that produces the least harm to the person.