Outsourced but Not Off the Hook: Preparing Your Small Business for the ICO's Hardening Line on Third-Party Data

There is a persistent misconception among smaller UK businesses that data protection obligations travel with the data — that once customer records sit in an accountant's system, a marketing agency's platform or a US-hosted CRM, the risk sits with the supplier. It does not. Under UK GDPR, you remain the controller, and the ICO's recent enforcement trajectory shows a growing willingness to pursue organisations that outsourced the processing but not the accountability.

For an SME with lean resources, the question is not whether you can achieve institutional-grade governance. It is whether you can demonstrate, on request, that you took reasonable and documented steps. That distinction is winnable.

Why the Enforcement Climate Has Shifted

The ICO has signalled a more interventionist stance: higher fines, a reformed penalty regime, and a stated focus on supply-chain failures. Breaches increasingly originate not within the organisation itself but at a vendor — a compromised email marketing platform, an ex-employee at a bookkeeping firm, a file transfer tool with lax controls. Regulators take the view that a controller who never asked questions cannot plead ignorance.

The practical consequence: if a processor loses your customers' data, you may be the one notifying the ICO, fielding subject access requests, and answering for the vendor's security posture.

The Questions Worth Asking Every Vendor

Before (and periodically after) engaging any third party that touches personal data, a short structured conversation will reveal most of what you need to know:

• Where is the data stored, and are there international transfers? If data leaves the UK, ask what transfer mechanism applies.
• What happens on termination? You want a defined return-or-delete commitment, in writing, with a timescale.
• Have they had breaches, and how were they handled? A credible supplier answers this readily.
• Do they hold any certification? Cyber Essentials, ISO 27001 or equivalent are useful signals, though not substitutes for contractual terms.
• Who are their sub-processors? Your data may pass onward to parties you have never heard of.

The Contract Clauses That Actually Do Something

Article 28 of UK GDPR requires a written processing agreement with every processor — but not all agreements are equal. The clauses with teeth are those that:

1. Impose specific security standards rather than vague commitments to "appropriate measures".
2. Require breach notification to you within a fixed, short window — hours, not weeks — so you can meet your own 72-hour reporting obligation.
3. Grant you audit or assurance rights, even if exercised rarely.
4. Allocate liability explicitly, including for sub-processor failures.
5. Govern deletion or return of data at the end of the engagement.

Many standard terms of service fall short on all five. Where a supplier resists amendment, weigh the commercial value of the relationship against the concentration of personal data involved.

A Practical Accountability Checklist

Accountability under UK GDPR means being able to show your workings. A lean but defensible audit file would include:

• A current record of processing activities, naming every processor and the data categories involved.
• Signed Article 28 agreements for each supplier, filed and dated.
• Evidence of due diligence at onboarding — certifications reviewed, security questions asked.
• An annual review of the vendor list, with leavers removed and changes noted.
• A documented breach response plan that contemplates a supplier-side incident.
• Training records for staff who handle data or manage vendor relationships.

None of this requires enterprise software. A spreadsheet, a folder of signed agreements and a calendar reminder will put most small businesses ahead of the majority of their peers.

The Cost Arithmetic

Compare the effort above with the alternative: regulatory investigation, remediation costs, notification obligations and the reputational damage of explaining to customers that their data was lost by a supplier you never vetted. Outsourcing is often the right commercial decision. Failing to govern it never is. Build the oversight now, while it costs you a few hours rather than a few penalties.