A data processing schedule will also form part of the contract. This acts as instruction to the supplier within what parameters they are able to process personal data.
This includes:
- Identity of the Controller,
- The subject matter of the processing,
- The nature of the processing,
- The purposes of the processing,
- The plan for the return and/or destruction of the data,
- Approved subcontractors.
We may ask for the suppliers assistance to complete this but in most situations the council, as per data protection legislation, will have complete discrepancy over its contents.
