Skip to main content
Skillrung

Entrusting your data to a service provider without losing control

Outsourcing processing does not move responsibility: it adds a written obligation. Each party's role is read in the facts, who decides the use and who carries it out, not in what the contract proclaims. Article 28 of the GDPR requires a written contract, which is worth exactly the concrete measures it describes. Two questions remain before signing: where your data will be processed, and which law that supplier is subject to.

  • Written by Skillrung team
  • Review by a subject-matter expert under way
  • Updated on
Read the first 4 slides, freePlay the Discovery quiz, free

What is this course about?

Know what to ask for, what to put in writing and what to check before entrusting your data to a service provider, and what to do when it changes.

This is a core course: the material taught is the same for everyone, only the examples, the tools mentioned and the people you deal with change with your job. It has 3 sections, of which 1 section is followed by a quiz, and reads in 20-30 min. The legal framework cited is French law.

The tool is theirs, the responsibility stays yours

Count the service providers that touch the data of your structure: the vendor of your business software, the host, the file-sharing service, the accountancy firm. You wrote none of those tools and you administer none of those servers. But the person whose information is circulating knows only you. This course starts from there: what moves to a provider is the work, never the responsibility.

Key points

The four checks you will be able to carry out

Four points to go back over for every provider already in place, and for every tool you are about to adopt.

  • Each party's real role, read in the facts
  • The content of the written contract, security measures included
  • The place of processing and the law applicable to the supplier
  • A change of sub-processor announced along the way

What you will be able to do

  • Place your own responsibility when a third party processes data on your behalf.
  • Check what a service provider does with your data before entrusting it to them.
  • Go back over, one by one, the providers that already hold your data.

The first 4 slides, free

What you read with no account and no card. Here, the generic version; in the player, the examples take the vocabulary of your job.

Try it, before you even create an account

Choose a job: the passage below is rewritten straight away. Nothing is saved, and no extra content opens.

No job selected: the generic version is being shown.

Generic version
Count the service providers that touch the data of your structure: the vendor of your business software, the host, the file-sharing service, the accountancy firm. You wrote none of those tools and you administer none of those servers. But the person whose information is circulating knows only you. This course starts from there: what moves to a provider is the work, never the responsibility.

Real extract from the free slide “The tool is theirs, the responsibility stays yours” of this course.

  1. FreeSlide 1 of 13 · Before you hand your data to someone else

    The tool is theirs, the responsibility stays yours

    Count the service providers that touch the data of your structure: the vendor of your business software, the host, the file-sharing service, the accountancy firm. You wrote none of those tools and you administer none of those servers. But the person whose information is circulating knows only you. This course starts from there: what moves to a provider is the work, never the responsibility.

  2. FreeSlide 2 of 13 · Before you hand your data to someone else

    What you will be able to do next

    • Tell a controller from a processor on the basis of the facts
    • Spot what is missing from a processing contract
    • Question a supplier about the place of processing and the applicable law
  3. FreeSlide 3 of 13 · Before you hand your data to someone else

    The four checks you will be able to carry out

    Four points to go back over for every provider already in place, and for every tool you are about to adopt.

    • Each party's real role, read in the facts
    • The content of the written contract, security measures included
    • The place of processing and the law applicable to the supplier
    • A change of sub-processor announced along the way
  4. FreeSlide 4 of 13 · Before you hand your data to someone else

    Where do you stand?

    One question before you start, to see where you stand. Nobody marks your answer.

    1 short questions, marked immediately, inside the course.

These 4 slides can be read in the player, with no account and no card.

Read the first slide

Programme

3 sections, 13 slides and 4 quizzes in total. Each content section ends with a quiz that checks it has been learned.

  1. IntroductionFree

    Before you hand your data to someone else

    Place your own responsibility when a third party processes data on your behalf.

    • 4 slides
  2. SectionSubscribers

    Sharing, outsourcing, hosting elsewhere

    Check what a service provider does with your data before entrusting it to them.

    • 7 slides
    • Section quiz: 5 questions
  3. RecapSubscribers

    Your action plan

    Go back over, one by one, the providers that already hold your data.

    • 2 slides

9 slides are for subscribers

The first four slides of this course can be read without an account and without a bank card. From the fifth on, the €29.99/month incl. VAT subscription is needed. The Beginner level quiz, though, stays free: it measures your level without asking you for anything.

Subscribe, €29.99/month incl. VATPlay the Discovery quiz, free

How your level is measured

  • Beginner
    Questions drawn
    10
    Pass mark
    70 %
    Question bank
    ≥ 30
    Time limit
    20 min

    Free, no account and no subscription.

  • Intermediate
    Questions drawn
    12
    Pass mark
    75 %
    Question bank
    ≥ 36
    Time limit
    24 min

    Subscribers only, once the Beginner level is passed.

  • Expert
    Questions drawn
    15
    Pass mark
    80 %
    Question bank
    ≥ 45
    Time limit
    30 min

    Subscribers only, once the Intermediate level is passed.

The level shown for a course is the highest level you have passed, with your best score and its date. Questions are drawn at random on every attempt. Play the Beginner quiz for this course or read how we measure your level.

Which jobs is it for?

Common core: the examples change with your job, what is taught stays the same. It addresses all 58 jobs in the directory. See courses by job.

Frequently asked questions

Is a written contract really mandatory with a service provider?

Yes. Article 28 of the GDPR requires a written contract between the controller and its processor. But a document that merely refers back to the Regulation is not enough: it must name the subject matter, the duration, the purpose and the categories of data, describe concrete security measures, provide for the assistance expected and settle what happens to the data at the end.

My provider is established in Europe: does that settle the question of transfers?

Not necessarily. What has to be checked is where your data is actually processed and which law applies to the supplier and to its own sub-processors. European servers can be administered from a third country, and a subsidiary belonging to a foreign group can be exposed to the law of its parent company. A transfer outside the European Union must be framed by one of the legal tools provided for by the Regulation.

My provider announces that it is entrusting part of the work to another company: what do I do?

You examine it, you do not file it away. Even when provided for in the contract, a general authorisation to use sub-processors takes nothing away from you: it obliges the provider to notify you of every addition or replacement, precisely so that you can object. Look at the new access to the data, at what frames processing from a third country, and at what your contract says about the objection period. Then record the decision and update your record of processing activities.

What can I read without a subscription?

The first four slides of every course are available without an account and without a subscription, as is the Beginner level quiz. From the fifth slide onwards, the €29.99/month incl. VAT subscription is required. Creating a free account unlocks no extra slide: it keeps your progress, your job and your results.

How is my level measured?

By three level quizzes: Beginner (10 questions, 70 % to pass), Intermediate (12 questions, 75 %) and Expert (15 questions, 80 %). The level shown is the highest level passed, with the best score obtained and its date.

Who writes and who reviews this course

  • Skillrung team

    Editorial team of skillrung.com

    The skillrung editorial team writes the courses from the publications of the French and European authorities: ANSSI, CNIL, Cybermalveillance.gouv.fr, Légifrance and EUR-Lex. Every figure is tied to its primary source, dated and verifiable from the course page. The team does not stand in for an expert reviewer: every course intended for publication is reviewed by a named professional of the field concerned, whose name and review date appear on the course page.

Artificial intelligence assisted the drafting. Editorial responsibility for the published text remains human.

Statements with regulatory scope verified on .

Sources

Every figure stated in this course points to a primary source, dated and verifiable.

  1. Règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 (RGPD)

    EUR-Lex, Union européenne, published on

  2. Le registre des activités de traitement

    CNIL, published on

  3. Les bases légales d'un traitement de données personnelles

    CNIL, published on

  4. Les durées de conservation des données

    CNIL, published on

  5. Professionnels : comment répondre à une demande de droit d'accès ?

    CNIL, published on

  6. Travailler avec un sous-traitant

    CNIL, published on

  7. Notifier une violation de données personnelles

    CNIL, published on

  8. Transférer des données hors de l'Union européenne

    CNIL, published on

What Skillrung is not

  • Skillrung is not a French training body certified under the Qualiopi scheme.
  • As things stand, our content is not eligible for the French CPF, OPCO, DPC or FAF funding schemes.
  • A Skillrung certificate of completion is not a diploma, not a professional title and not a qualification registered in any national register. It records a result obtained in an unsupervised online assessment, on a given date.
  • Taking a Skillrung course does not make your organisation compliant and does not replace the obligations that fall on your employer or on you.
  • Our content is educational. It is neither legal advice, nor medical advice, nor a security audit.
  • For a self-employed professional or a company, the subscription is a deductible business expense : confirm this with your accountant.

Same topic

The other compliance & personal data courses

See the whole catalogueOur method

Keep going on Skillrung

The pages that follow on from this one, in the recommended order.