Where is your data stored, and who processes it?
Almost every company processes personal data. Learn why you need to know where your data is stored, which parties handle it and how to regain control.
Every organisation with customers, patients, clients or employees processes personal data: names, email addresses, addresses, invoices, records. That data is rarely in one place. It passes through your hosting provider, your email suite, your CRM, your accounting software, your analytics tools and the backups of all those systems. Yet many organisations cannot say with certainty where that data is stored and which parties have access to it.
Under the GDPR that is not a detail. As the data controller, you remain responsible for your data, even when a supplier does the work.
Why this is more than a legal formality
If you do not know where your data is stored, there are three things you cannot do well. You cannot answer a customer's or regulator's question ("who has my data?"). You cannot quickly assess who is affected by an incident and whom you need to inform. And you cannot demonstrate that you have taken appropriate measures, which is exactly what the GDPR asks of you.
Trust has also become a procurement criterion. Municipalities, healthcare institutions, law firms and financial service providers increasingly ask their suppliers to show where data is stored and who can access it. Those who have this clear win assignments faster.
Your data is with more parties than you think
A processor is any party that processes personal data on your behalf. Think of your hosting provider, your email and collaboration tools, a CRM or ticketing system, a payment provider, marketing and analytics tools and an external helpdesk. These parties in turn often engage sub-processors: a cloud platform, a support team in another country, a separate backup supplier.
Every link in that chain is a place where your data can be stored or where someone can gain access to it. Under the GDPR, you must authorise sub-processors and the main processor remains responsible for the chain. In practice, this is not always monitored.
The question is not only “where is my data stored”, but also “who can access it, from which country and under which legislation?”
Where it goes wrong in practice
- Shadow IT. Teams adopt tools on their own without anyone checking what is stored in them.
- Remote access. Data is stored in Europe, but a support team or parent company outside the EU can still access it. That too can count as a transfer to a third country.
- Outdated agreements. The data processing agreement was signed years ago and the supplier now uses different sub-processors.
- Foreign legislation. European subsidiaries of American providers can fall under the American Cloud Act. Earlier frameworks for transfers to the US (Safe Harbor and Privacy Shield) were invalidated by the Court of Justice of the European Union, which shows that arrangements in this area can change.
Getting a grip on your data in five steps
- 1
Map your personal data
Which data do you process, about whom, and in which systems is it stored?
- 2
List every party involved
Including sub-processors. Ask your suppliers for their current list.
- 3
Check location and access
Where is the data stored, and who can access it, including remotely? Watch for support teams and parent companies outside the EU.
- 4
Check the processing agreements
Does every processor have one, and does it still match reality?
- 5
Record it and repeat
Keep your record of processing activities up to date and review it at least annually, and whenever you add a supplier.
Where Verulon helps
At Verulon, this overview is the starting point. We develop custom software and host it on our own servers in the Netherlands, under Dutch law. That lets us state exactly where your data is stored, which parties are involved and who has access, with no foreign parent company and no unclear chain of sub-processors.
Want to know where your own organisation stands? Start by answering these questions:
- For every system that holds personal data, do you know where the data is physically stored?
- Do you have an up-to-date list of all your processors and their sub-processors?
- Is there a data processing agreement with every processor, and is it still accurate?
- Do you know who has access to your data, including from abroad?
Cannot answer one or more of these with certainty? Feel free to get in touch. We are happy to think along, whether or not it leads to a collaboration.