Digital service companies (DSC) · GDPR

DSC & GDPR: the obligations of the technical data processor

In managed services, third-party application maintenance, or hosting, an IT services company accesses its clients' personal data on their behalf: it acts as a processor within the meaning of the GDPR. It must provide sufficient guarantees and precisely contractualise its responsibilities. This guide details the obligations of the technical processor, cases of independent liability, and an operational roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • Any IT services company processing personal data on behalf of its clients is a data processor, with no threshold.
  • Sign a compliant DPA.
  • Process under instruction.
  • Secure (Article 32).
  • Fines can reach €20 M or 4% of global annual turnover.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

GDPR distinguishes between the data controller, who determines the purposes, and the data processor, who acts on its behalf. An IT services company that operates or maintains systems containing personal data is a data processor, without defining the purposes thereof.

Article 28 requires a written contract strictly governing what the processor may do and how it secures the data.

Is the 'Digital Service Companies (DSC)' sector concerned?

Any IT services company processing personal data on behalf of its clients is a data processor, with no minimum threshold. Classification depends on the actual access to data, not on the 'technical' nature of the service.

For its own processing activities — HR management, recruitment, business prospecting — the IT services company acts as data controller and therefore holds both roles simultaneously.

Detailed obligations

Sign a compliant DPA

Formalise with each client a data processing agreement compliant with Article 28: subject matter, duration, nature of the processing, categories of data, obligations and rights of the controller.

Process on instruction

Process data only on documented instructions from the client and raise the alarm if an instruction is non-compliant.

Secure (Article 32)

Granular access and permission management, encryption, strong authentication, logging, backups and restoration testing.

Govern sub-processors.

Maintain an up-to-date list of sub-processors (hosting providers, software vendors, other service providers) and inform clients of any changes.

Govern transfers outside the EU

Legally securing transfers outside the European Union through standard contractual clauses and supplementary measures.

Assist the client

Assist with rights requests, impact assessments and breach notification, and alert the client without delay in the event of a breach.

Sanctions & risks

Fines can reach €20M or 4% of global turnover. A failing IT services company exposes all of its clients in a cascading effect, making it a systematic control point in due diligence.

Contractual risk compounds administrative risk: clients demand DPAs, security guarantees, and audit rights.

Common mistakes in the sector

  • 1DPA on a case-by-case basis. Negotiating without standard contracts, slowing down sales and leaving gaps.
  • 2Hidden sub-processors. Failing to declare the host or third-party providers.
  • 3Ungoverned transfers. Using non-EU services without clauses or measures.
  • 4"Technical service" = no GDPR. Wrongly believing that the technical nature of the engagement exempts from the role of data processor.

Practical case

An IT services company providing application maintenance for a client's ERP subcontracted hosting to an undeclared third party located outside the EU. A client audit blocked contract renewal. The company remediated the situation by declaring the subcontractor, activating transfer clauses, and publishing a standard DPA, now included with every commercial proposal.

Compliance roadmap

  1. 1

    Map. Map services providing access to data and their location.

  2. 2

    Publish a standard DPA. Making a standard DPA and security documentation available.

  3. 3

    Maintaining the list of subprocessors. Keep sub-processors and client information up to date.

  4. 4

    Document security. Formalise Article 32 measures in a register.

  5. 5

    Equip the notification process. Implementing a breach notification procedure for the customer.

Frequently asked questions

No: as soon as it provides access to personal data, the IT services company is a processor, regardless of the technical nature of the engagement.

Back to the Digital service companies (DSC) guideDigital service companies (DSC) & NIS2 Digital service companies (DSC) & AI Act Digital service companies (DSC) & DORA

Take action on GDPR

Free assessment or a chat with an expert dedicated to digital service companies (dsc).

Start my free assessment Talk to an expert

They already trust us

See how organisations in the digital service companies (dsc) sector secured their compliance with DCO.

See testimonials