Sharing data with suppliers: what a data processing agreement is for

If a supplier such as a payroll provider, IT support company, or CRM tool processes personal data on your behalf, GDPR expects a data processing agreement setting out what they can and can't do with it and how it's protected — a verbal understanding isn't enough. Most reputable suppliers already have a standard DPA ready to sign; if one doesn't, that itself is worth asking about.

Coach's tip: keep a simple list of every supplier who touches customer or staff personal data — most businesses are surprised how long that list actually is once they write it down.