In this blogpost we ask if site owners must assess whether all their website-3rd parties' processing operations pose risks to their website visitors.
We will explain how Trackerdetect automatically detects and builds information about 3rd parties on your website to help you identify all 3rd parties on your website so that you can assess whether your website-3rd parties' processing operations pose risks to the rights and freedoms of your website visitors and whether a DPIA is necessary, in accordance with GDPR.
In the following it is assumed that
- you have 3rd parties on your site
- the personal data of your website visitors are disclosed to the 3rd parties on your site
Assess Risk Likelihood
If you are a website owner, you can ask yourself
“Must I assess whether all my website-3rd parties' processing operations pose risks to the rights and freedoms of my website visitors?”
The answer is yes.
This is the rule in GDPR Article 35.1.
Site owners must assess whether their website-3rd parties' processing operations are “likely to result in a high risk to the rights and freedoms of natural persons.”
How to assess risk likelihood?
GDPR Article 35.3 provides some examples when a processing operation is “likely to result in high risks.”
To learn more about how to assess risk likelihood, look at WP29 Guidelines on Data Protection Impact Assessment (DPIA) (wp248rev.01).
The Guide provides 9 criteria that should be considered when assessing whether processing operations are “likely to result in a high risk”.
The more of the 9 criteria that are met by your website-3rd parties' processing of your website visitors' personal data, the more likely it is to present a high risk to your website visitors' rights and freedoms.
Assess Impact on Website Visitors' Personal Data
If you also ask yourself
“Must I carry out a Data Protection Impact Assessment (DPIA) for every website-3rd party's processing operations?”
The answer is no.
This is the rule in GDPR Article 35.1.
Site owners are required to carry out a DPIA only when their website-3rd party's processing operation is “likely to result in a high risk to the rights and freedoms of natural persons” (GDPR Article 35.1).
How to carry out a DPIA?
To learn more about how to carry out DPIAs, look at WP29 Guidelines on Data Protection Impact Assessment (DPIA) (wp248rev.01)
How can Trackerdetect help?
With Trackerdetect you can automatically detect all 3rd parties on your site
- at a given time by manual clicks
- at given intervals, e.g. each 6th hour
- from a given location
- and store the information about the 3rd parties in a record with Signatu
- and find out what the detected 3rd parties typically do
- including information about their
- legal entity
- contact details
- etc
Trackerdetect will enable you to identify 3rd parties that are on your site so that you can assess whether their processing operations are “likely to result in a high risk to the rights and freedoms of natural persons (read: your website visitors)” and, hence, determine whether you must carry out a DPIA.
Other blogposts on Trackerdetect
In other blogposts about Trackerdetect on
- Oh heck, do I have a lot of 3rd parties on my website?
- Keep a record of all 3rd parties on websites?
- Inform about all 3rd parties on websites in Privacy Policy?
- Inform about 3rd parties on websites in Access Request response?
- Notify 3rd parties on websites of site visitors' request to exercise rights?
- Classify 3rd parties on websites as Controllers, Processors etc?
- Assess risk of having 3rd parties on websites?
- Internal policies for having 3rd parties on websites?
- Is having unauthorised 3rd parties on a website a personal data breach?
- Must I have a tool to identify and record 3rd parties on my website?
we have explained reasons why you should become aware of 3rd parties on your site and how Trackerdetect automatically detects and builds a record of 3rd parties that are on your website to
- help you meet the record keeping requirements in GDPR Article 30.1.
- help you meet the information and transparency requirements in GDPR Article 13.
- help you respond to your website visitor's Access Request in GDPR Article 15.
- equip you with their contact details so you can communicate to those 3rd parties that your website visitor requests to exercise his/her right.
- enable you to classify 3rd parties to determine whether or not you are required to enter into an agreement with the detected 3rd parties, as required in GDPR (data processing agreement (GDPR Article 28), joint controller agreement (GDPR Article 26), controller to controller agreement).
- help you identify all 3rd parties on your website so that you can assess whether your website-3rd parties' processing operations pose risks to the rights and freedoms of your website visitors and whether a DPIA is necessary, in accordance with GDPR.
- help you understand how 3rd parties appear on your website so that you can adopt internal data protection policies for having 3rd parties on your website, as required by GDPR Article 24.
- help you to identify whether unauthorised disclosure of your website visitors’ personal data have occurred and whether you need to notify the personal data breach to the supervisory authority and your website visitors.
- help you to be able to demonstrate that you have the technological measures to detect and record 3rd parties on websites, as required by the GDPR Articles 24.1, 30.1(d) and Recital 87.
Reach out to us
If you have an interest in Trackerdetect, please send us an email to hello@signatu.com.