RCDENStart a project
Choose a section

Section 10 / Supplier completes

Issued form · page 5

Data protection

Identify whether you will act as RCDEN’s processor, then provide one privacy contact and fee-status reference.

When this applies

The processing role determines whether Article 28 terms are needed. Business-contact data can be processed on another organisation’s instructions, so the type of data alone does not settle the role.

Help with this section

Open a question for help. The numbers match the printed questions and agreement clauses.

10.1

Processing on RCDEN’s instructions

What to enter

Select Yes, No currently identified or Not yet determined. A processor handles personal data on a controller’s behalf. Exchanging contacts for each party’s own business administration does not, by itself, create that relationship.

Check applicability

If the role is uncertain, resolve it before processing. A required Article 28 contract cannot be replaced by this registration signature.

Where to find it / what to do next

  1. Identify whose personal information you would handle and who decides the purpose and use of it.
  2. For example, a recruiter may independently control candidate sourcing while an employer independently controls hiring decisions. The role depends on the actual activity, not simply on being a supplier.

Useful external help

Opens in a new tab so you can keep this question open.

If you are still unsure

Use Not yet determined if the proposed processing is unclear. Confirm the activity and any required data agreement before that processing begins.

Link to question 10.1 Your issued form · page 5
10.2

Privacy contact and ICO fee status

What to enter

Use Same if the contact in 2.6 also handles privacy, or provide the different business contact. Record the ICO fee number, exemption basis or Assessment pending. Not every supplier must appoint a DPO, and fee registration is not GDPR certification.

Where to find it / what to do next

  1. Search the ICO register using your legal or trading name and check that the entry belongs to your organisation.
  2. Copy the registration or fee number, not the company number or VAT number. Your registration confirmation or renewal notice may also show it.
  3. If no entry is found, use the ICO fee self-assessment to check the position. Record a supported exemption basis or Assessment pending as appropriate.

Useful external help

Opens in a new tab so you can keep this question open.

If you are still unsure

A missing register entry does not prove an exemption. A small business can name the person responsible for privacy without claiming to have a formally appointed Data Protection Officer.

Link to question 10.2 Your issued form · page 5

If more detail is needed

For the relevant work only. These are not extra questions in the initial registration.

Details requested in the addendum

If processor or transfer duties apply, identify the activity, purpose, duration, data categories and people affected, processing/access countries, subprocessors and permissions. Reference the Article 28 agreement, security assurance and applicable transfer route/assessment.

Provide descriptions and categories, not live personal datasets. Required contract terms and safeguards must precede the affected processing or restricted transfer. Processors notify the controller of breaches without undue delay.

How to use the addendum →

This guide explains form v2.0. It does not amend the issued requirements or approve work, exceptions or information release. Use the external help to find records and understand the rules. For questions about RCDEN's requirements or the proposed work, use the contact in Section 1.2 and quote the question number.