DPDP for Engineering, Auto Components and Machine Tools

Our customer sent a data protection questionnaire. Does answering it make us compliant?

No. It gives your customer evidence about the data you handle for them. It says nothing about your own workforce records, the laptops your drawings and quality files sit on, or whether you could report a breach inside the deadline.

You are a fiduciary in your own right for your workers, applicants and vendor contacts, and no customer questionnaire covers that.

ACT · Sections 8(1), 8(2) and 8(5).

Are we a Data Fiduciary or a Data Processor?

Usually both, in different places at once. For any data you process to your customer's specification and for its ends, you are its processor and the Act requires a valid contract between you. For your own employees, applicants and supplier contacts you are the fiduciary, because you decide the purpose and the means.

The label is not a status you hold. It is decided activity by activity.

ACT · Sections 2, 8(1) and 8(2).

Traceability records carry an operator name against every batch. Is that a problem?

No. A record naming an identifiable person is personal data, but keeping it is lawful because it is processing related to safeguarding the employer from loss or liability, and quality traceability is exactly that.

What follows is ordinary. Secure it, be able to say how long you keep it and why, and remember it is disclosable to that operator if she exercises her right to a summary of what you hold.

ACT · Sections 4, 7(i), 8(5) and 11.

Can we be penalised if our customer suffers a breach involving data we handled?

The fiduciary answers to the Board for its own failures, including for processing carried out on its behalf, and that responsibility holds irrespective of any agreement to the contrary. So your customer will be in the frame.

You will not escape it commercially. The security obligations the Rules require in the processor contract are yours to meet, and the loss travels back down that contract.

ACT · Sections 8(1), 8(2) and 33; RULES · Rule 6(1).

Our original equipment customer is responsible for compliance. We just follow their instructions.

For their data, they carry the responsibility and you carry the contract. For your own workers, applicants and vendor contacts you are the fiduciary yourself, and there is nobody standing behind you.

The vendor audit questionnaire the customer sends is our compliance.

It is evidence for them, not compliance for you. It says nothing about your own workforce data, the security of the laptops your quality records live on, or whether you could actually report a breach in time.

Traceability records naming an operator are quality records, not personal data.

A record that names an identifiable person is personal data whatever else it also is. Keeping it is lawful, because it safeguards you against liability, and it still attracts the security and breach duties.

We are only a supplier, so we cannot be penalised.

Penalties attach to a fiduciary for its own failures, and you are a fiduciary for your own people. Where you act as a processor you still owe the security terms your contract has to carry, and the fiduciary will pass its loss straight down that contract.