3 ms·
What happens if your service lets users manage their own customers’ data? I mean, for a product such as Airtables, FieldBookApp, Sharepoint Forms or, simply, Go
by tajen 9y ago
What happens if your service lets users manage their own customers’ data? I mean, for a product such as Airtables, FieldBookApp, Sharepoint Forms or, simply, Google Forms: Are we, cloud app providers, supposed to ensure our users don’t put PII data in the spreadsheets, and if they do, are we supposed to manage their users’ consent and process their users’ requests for edition and deletion? At the extreme, what should Heroku do for the Postgres darabases they provide to their customers ?
I could only find GDPR blogs about apps facing the final users, but they generally don’t talk about compliance for B2B apps.
- Sylos 9y agoIn that case, your customer is the "controller" and you're the "data processor". The whole GDPR is written with such B2B relationships in mind. Chapter 4 is specifically all about that. Article 28 specifies the situation for the data processor: https://gdpr-info.eu/art-28-gdpr/ https://gdpr-info.eu/art-28-gdpr/ And well, basically your customer has to tell you all of these things in the contract. (Article 28 Section 3) Furthermore, if you yourself want to pass that data on to another data processor, you have to notify the controller of that and tell that data processor those things that the controller specified in the contract, too. It's also in the responsibility of the controller to select data processors that implement "appropriate technical and organisational measures". That's a term that you should also find plenty of literature and discussions on. The GDPR specifies somewhat in its recitals: https://gdpr-info.eu/recitals/no-78/ https://gdpr-info.eu/recitals/no-78/ And you might also want to get certified that you are GDPR-compliant, just to make it trivial for customers to see that you can implement those appropriate organizational and technical measures.