It can be useful to review all agreements with suppliers to make sure that the supplier assumes the expected responsibilities and that there is transparency around your handling of data here too.

In line with the scope of the collaboration, an agreement should be drawn up that allocates responsibilities and makes it clear that the subcontractor is acting on the instructions of the data controller, your company, but complies with the applicable regulations.

Not least, the agreement should emphasize that the data processor only "processes" but does not use your data for its own purposes.

In addition, it is of greater importance where your subcontractors are located geographically - not least whether they are members of the EU. If they are located outside the EU, the recipient country must ensure a special level of protection and comply with the applicable clauses approved by the Danish Data Protection Agency.