In that case, your customer is the "controller" and you're the "data processor". The whole GDPR is written with such B2B relationships in mind. Chapter 4 is sp

In that case, your customer is the "controller" and you're the "data processor". The whole GDPR is written with such B2B relationships in mind. Chapter 4 is specifically all about that. Article 28 specifies the situation for the data processor: https://gdpr-info.eu/art-28-gdpr/ https://gdpr-info.eu/art-28-gdpr/ And well, basically your customer has to tell you all of these things in the contract. (Article 28 Section 3) Furthermore, if you yourself want to pass that data on to another data processor, you have to notify the controller of that and tell that data processor those things that the controller specified in the contract, too. It's also in the responsibility of the controller to select data processors that implement "appropriate technical and organisational measures". That's a term that you should also find plenty of literature and discussions on. The GDPR specifies somewhat in its recitals: https://gdpr-info.eu/recitals/no-78/ https://gdpr-info.eu/recitals/no-78/ And you might also want to get certified that you are GDPR-compliant, just to make it trivial for customers to see that you can implement those appropriate organizational and technical measures.