Contact

who has access to client data?

We will check which data reach the vendor, who is accountable for them and whether the contract properly describes the cooperation. If needed, we will prepare documents, procedures and checklists for the team.

Book a brief call

do not start with the contract

In a vendor relationship we too often jump straight to a document. Someone asks for a data processing agreement, someone else sends a ready template, and the management board is already under pressure to launch the service.

But first you need to establish what actually happens to the data: who decides on the purposes, who has access, where the data go, whether there are subprocessors, how deletion works and who responds to an incident. Only then does the document match the cooperation.

Łukasz Bojarski

Senior Associate

Most common challenges

When it becomes unclear

A vendor is meant to help with the work: implement a system, run a process, deliver a campaign, maintain a tool or take over part of the tasks. Along the way, however, it gains access to data. That is when you need to know whether the contract, the operating model and the parties’ accountability truly align.

You do not know what role the vendor plays The vendor runs a system, a campaign, payroll, hosting or an IT process. In practice it may act solely on your instructions, but it may also decide itself on part of the data operations. That determines which documents are needed and who takes accountability for the cooperation.

that is why we verify it

We will establish the vendor’s role in the specific cooperation model: processor, controller, joint controller or a mixed model. We will check whether a data processing agreement is enough, or whether other provisions, additional instructions or a contract change are needed.
The contract does not explain what happens to the data A document may be signed and still fail to answer the most important questions: which data reach the vendor, who has access to them, where they are stored, whether the vendor engages subcontractors and what happens after the cooperation ends.

that is why we make sure it clearly explains the rules of cooperation

We will review the contract, GDPR annexes, instructions, the subcontractor list, transfers and deletion rules. We will indicate what needs to be added, corrected or clarified with the vendor so the documents describe the service as it works in practice.
You do not control where the data go You use SaaS, cloud or a global tool. In the contract you see one vendor, but hosting, support, subcontractors, integrations or entities outside the EEA may also be involved in the service.

that is why we verify the processing chain

We will check who really takes part in working with the data: where they are stored, who has access, whether the vendor uses subcontractors and whether data leave the EEA.
You do not know what to do in an incident An incident, a complaint or a data subject request arises. There is then no time to work out from scratch who contacts the vendor, where the data are, what information must be gathered and which deadlines are already running.

that is why we create a process

We will set out the rules for such situations. You will know who reports the matter, who responds on the vendor’s side, what information must be shared, how to document the response and when to involve legal, the DPO or the management board.

Our solution

We will improve your relationship with the vendor

We do not stop at a DPIA, a question table or a list of items “for further analysis”. If a vendor is to work on data, we help take the whole topic through: from defining roles and data flows, through document review, to contract corrections, procedures and working rules for the team.

We will define the roles

Before a contract is drafted, you need to know whether the vendor is a processor, a controller, a joint controller or plays several roles at once.

 

We can:

  • analyse the vendor cooperation model,
  • establish who decides on the purposes and means of processing,
  • check whether a data processing agreement is the right document,
  • identify where the parties’ roles are unclear,
  • prepare a rationale for the DPO, the management board or the business.

 

The result of this stage is

  • roles and data-flow matrix

We will check what the vendor does with the data

Before you sign a contract or grant access, you need to know what service the vendor is to perform, which data it will receive, who else may see them and whether the documents describe what the vendor may do with the data.

We can:

  • review the contract, annexes, service description, vendor policies and tool information
  • establish which data will reach the vendor and what they will be used for
  • check whether the vendor uses subcontractors, cloud, support or tools outside Europe
  • prepare questions for the vendor, without leaving you with a list of doubts alone
  • turn the vendor’s answers into a decision: what can be accepted, what must be corrected, and what should not be signed without changes

 

The results are:

  • vendor cooperation assessment
  • access map

We will prepare the contracts

If the relationship requires documents, we will prepare them for the specific service, not a template. The contract should describe precisely and simply what the vendor does with the data, not merely repeat the legislation.

We can:

  • prepare a data processing agreement,
  • correct the GDPR annex to the main contract,
  • add processing instructions, data categories and the parties’ duties,
  • regulate subprocessors, transfers, audits, incidents and termination of cooperation,
  • prepare provisions for a contract with a controller or joint controller if processing on behalf does not fit the relationship.

 

The results of this stage are:

  • contracts
  • contract annexes
  • clauses, including NDAs
  • instructions for each vendor separately

We will implement procedures

The problem does not end when the contract is signed. Someone in the company must know when to check the vendor, which questions to ask and who approves the cooperation before the service goes live.

 

We can:

  • prepare a vendor selection and approval procedure,
  • create a checklist for procurement, HR, marketing, IT or operations,
  • describe the vendor approval path through legal, the DPO, compliance or the management board,
  • establish what must be checked before signing the contract,
  • prepare rules for updating documents after a change of vendor or service.

 

The result is:

  • processor cooperation procedure

We will check whether your documents are correct

Sometimes the documents look fine but do not match how the service works. More people have access to the data, data are exported, the vendor uses subcontractors, and deletion after the cooperation ends is not described.

 

We can:

  • compare the contract with how the service operates,
  • check access, the data scope, retention periods and deletion methods,
  • identify gaps between the vendor’s declarations and the documents,
  • prepare a list of questions to clarify with the vendor.

 

The results of this stage are

  • audit
  • list of gaps and corrections
  • recommendations

We will prepare the team

The best document will not help if the people buying services do not know when to involve legal, the DPO or compliance. That is why we can prepare simple materials for working with vendors.

We can:

  • prepare guidance for people selecting vendors,
  • write a checklist before buying a tool or services,
  • prepare a team message about the new cooperation rules,
  • indicate when the matter requires consultation with legal, the DPO or the management board,
  • help explain to the team what not to declare without checking first.

 

The results are

  • checklist
  • guidance
  • message
  • implementation materials
  • action path before vendor selection

Who this service is for

For organisations that want data under control

Working with a processor rarely belongs to one department alone. Someone selects the tool, someone negotiates the contract, someone is accountable for the data, someone must prepare the company for an audit, and someone ultimately takes accountability for the decision.

We help those people structure the vendor relationship so it is clear who is accountable, what must be signed and how to work with the vendor after the service starts.

Legal | in-house

When the contract is almost ready, but you need to check whether roles, GDPR annexes, subprocessors, transfers and the parties’ accountability are properly described. We help translate the cooperation model into provisions that can be signed and applied.

  • contracts
  • roles
  • provisions

DPO | Compliance

When you need to assess a vendor, check data flows, prepare documentation or answer questions from an auditor, a client or the management board. We organise information about the data, the vendor, safeguards, transfers and subprocessors.

  • data
  • audit
  • procedures

Operation Manager

When you are selecting a vendor, but before signing the contract you need to know which questions to ask and which documents to collect. We will prepare a checklist, an approval path and requirements worth sharing with the vendor before cooperation starts.

  • purchase
  • vendor
  • approval

HJR

When your team is implementing a tool, system, agency or service that will work on employee, client, candidate or user data. We will help check what needs to be reported, which documents to prepare and when to involve legal, the DPO or compliance.

  • tools
  • data
  • implementation

Management board | COO | CEO

When cooperation with a vendor may affect the organisation’s accountability, an audit, client relationships or data security. We will prepare a short recommendation: what requires a decision, what must be corrected and whether cooperation can be launched in the current model.

  • decision
  • accountability
  • risk

Stages of work

Four steps to an organised relationship with the processor

The process is simple: first we check how this cooperation actually works. Then we organise the model, the documents and the implementation rules.

We analyse

We establish who the supplier is, what service will be provided and what data will be processed.

We review

We review the roles, data scope, subprocessors, transfers, safeguards, incidents and termination of the relationship.

We prepare

We prepare or revise the data processing agreement, annexes, procedures, checklists or a recommendation for decision-makers.

We implement

If needed, we help explain the new rules to the team and establish a way of working with future suppliers.

Book a short call.

Book a brief call

Contact us

Let’s start with a conversation about the vendor

You do not need a ready diagnosis or full documentation. Tell us which service you want to launch, who is to receive access to the data and what decision you face. We will help establish what really needs to be checked before the next step.

Your message is read by

Natalia Jabcoń

They will get back to you with follow-up questions or a proposed next step.

Quick response

We usually respond within two hours on business days.

    By submitting this form, you acknowledge that the personal data you provide will be processed by Kancelaria Prawna Sawaryn i Partnerzy sp.k. to handle your enquiry and contact you about it. Details are available in our Privacy Policy. The rules governing the use of this website are set out in the Terms and Conditions.