What does Alfa do with your personal data?

29 mei 2018

If, as a company or organisation, you record personal details, then the General Data Protection Regulation (GDPR) applies to you. You must ensure the appropriate organisational and technical measures to do so. But what happens if you outsource the processing of this data?

Is Alfa the processor or the party responsible for processing?

This will depend on the assignment you have given Alfa. When auditing or drafting annual accounts, Alfa will be the party responsible for processing data. When processing your (payroll) administration, Alfa is the processor.

Processing contract

For the activities in which Alfa acts as the processor, you will be required to conclude a processing contract with Alfa. This processing contract among other things will record which data Alfa processes and what measures we as the processor have put in place to safeguard and secure personal data.

Alfa in full preparation mode

As you know, we always handle your details appropriately and with care. As data processor and in compliance with the current Dutch Data Protection Act, we have recorded the measures taken which apply to our services in our privacy conditions. We are currently in the process of determining whether the measures included in our conditions will suffice for the new GDPR obligations. The renewed processing contract will of course meet with all the demands set out by the GDPR. As we like to keep things secure and clear, we will present you with the new processing contract before 25 May.

More information?

You can read all about what you as an entrepreneur will be obliged to do regarding personal data to comply with the GDPR in "What do the new privacy regulations mean to you?".

Processing personal data

Your company can process personal details in many forms, such as consumers' client details or your employees' payroll administration. This makes you the party responsible for processing this data. But what happens if you do not have the skills and/or time required to perform the various tasks involved and outsource (part) of the processing to a third party?

You can also visit the Dutch Data Protection Authority website.