I am a data controller wanting to outsource some of our information for processing purposes. What are the data protection implications?
You must choose an organisation that you consider can carry out the work in a secure way and you should check that you are doing this. You should have a written contract with them that lays down how they can use and disclose the information you have entrusted to them. It must require them to take proper security measures. Our good practice note on Outsourcing – a guide for small and medium sized businesses has more information on this subject.