Personal Data Processing Outsourcing · Third-Party Provision
Personal Data Processing Entrustment vs. Third-Party Provision
What is personal data processing outsourcing?
- The test is whose business and interests the processing serves
- Outsourcing needs a written contract, disclosure, and oversight of the processor; provision needs consent
- Hand over only the items needed and confirm destruction after the work ends
When personal data goes outside the company, it is easy to assume that a contract titled ‘outsourcing’ makes it outsourcing. But the test is not the title; it is whose business and interests the data is used for. When a company hands a training vendor its learner list so the vendor can run the training, the vendor is handling the company’s own training work on its behalf, which is processing outsourcing. If the vendor uses the same list to promote its own open enrollment programs, from that moment it becomes third-party provision for the recipient’s benefit.
The two cases require different procedures. Processing outsourcing does not require separate consent from data subjects, but the company must do three things: outsource in writing, with a document covering the purpose and scope of the outsourcing, a ban on processing beyond that purpose, limits on re-outsourcing, safeguards, supervision, and liability for damages; disclose the outsourced work and the processor in the privacy policy or similar; and train the processor and monitor how it handles the data. If the processor wants to subcontract the work, the outsourcing company’s consent is required.
Third-party provision generally requires the data subject’s consent, and you must tell them the recipient, the purpose of use, the data items, the retention period, and their right to refuse. When the case is unclear, look at who controls and manages the data after it is handed over. If it is used only within the scope the company directed and is returned or destroyed once training ends, it is outsourcing; if the recipient makes its own decisions and keeps and uses the data, it is provision. Check the statutory provisions and penalty levels against the latest guidance from the Personal Information Protection Commission.
Where practice goes wrong is the Excel list sent off in a single email. At the quote stage, names, departments, and contact details change hands with no contract, and they stay in the vendor contact’s inbox long after the training ends. If the processor causes an incident, the law treats the processor as an employee of the outsourcing company, so the company bears the liability. Three steps are the minimum defense: hand over only the fields you need, write destruction after the training ends, and confirmation of it, into the contract, and keep the processor list in your privacy policy in line with reality.
Seolyeong ParkGenerative AI and AX training expert with 17 years of hands-on experience and 200+ sessions, making AI usable right away even for non-specialists
Seungtae ParkPractical AX instructor who teaches by building AI business development and marketing automation hands-on| Category | Processing outsourcing | Third-party provision |
|---|---|---|
| Who is the processing for? | The work and interests of the company handing over the data (the outsourcer) | The recipient’s business and interests |
| Who manages it after handover | The outsourcing company instructs and supervises | The recipient manages it independently |
| Data subject consent | Separate consent generally not required | Consent generally required |
| What the company should do | Written contract, disclosure of the outsourcing, training and supervision of the processor | Consent after notice of the recipient, purpose, items, and retention period |
| An example from training practice | Sending the participant list to a training vendor that runs the program | The training vendor uses that list to promote its own programs |
| Liability for incidents | The processor is treated as the outsourcing company’s employee, so the company is liable too | The recipient is responsible as an independent processor |
The Personal Information Protection Act splits cases where personal data leaves the company into processing outsourcing under a business outsourcing arrangement and third-party provision, and sets different obligations for each. Court precedents and regulators’ interpretations tell them apart by weighing whose business and interests the recipient processes the data for, and who manages and supervises it after it is handed over.
Consider a hypothetical case. The training team at Company A, a manufacturer with 900 employees, decided to outsource a leadership program for 120 newly promoted employees to an outside training vendor, Company B. Last year they emailed an Excel file containing names, employee IDs, departments, mobile numbers, and the first digits of resident registration numbers, and the contract had no personal data clause at all.
- When the training team's assistant manager was about to send the same Excel file again this year, the privacy manager blocked it. "This is outsourcing, so the outsourcing agreement and a published privacy policy come first."
- The manager cut the fields to hand over to Company B down to three: name, department, and company email. An assistant manager said, "We don’t need dates of birth to take attendance," and deleted the other columns.
- A sales rep at Company B asked, "May we email course completers about our open enrollment programs?" The manager declined, since that would be third-party provision outside the scope of the outsourcing.
- The contract banned use beyond the stated purpose, required prior consent for any subcontracting, and required data to be destroyed within 30 days after training ended, with a certificate of destruction submitted. The CEO of Company B signed it.
- The training team listed Company B and the outsourced work in the processor list of the company’s privacy policy, and before the course began, briefed Company B’s three operators on data-handling requirements.
- After the course ended, Company B sent a destruction confirmation on day 28, and the categories of personal data handed over fell from 7 last year to 3.