Third-Party Risk and Data Protection Boundaries

Third-party risk and data protection boundaries arise because one provider can play two roles at once: an ICT supplier under DORA and a handler of personal data under data protection law. The two regimes overlap but they are not interchangeable. DORA assurance about resilience does not prove that personal data is handled lawfully, and data protection paperwork does not prove that a service will recover from disruption. The entity therefore needs to manage both sets of duties distinctly, while recognising where they interact, such as security measures, subcontracting, data location and incident cooperation. Keeping the boundary clear prevents each regime from being used as a substitute for the other.

A customer onboarding illustration shows the overlap. An identity verification provider supports an important service, so its resilience matters under DORA, and it also processes personal data belonging to applicants, so its data handling matters under data protection law. The entity's relationship with the provider must address both dimensions: the service must keep running and recover, and personal data must be processed only as instructed, kept secure, and not retained beyond what is needed. Contract terms, oversight and evidence should reflect both dimensions, with each one assessed on its own terms rather than assumed from the other.

Data protection arrangements typically distinguish the party that determines purposes and means from the party that processes data on its behalf, and the processing party should act only on instructions from the determining party. That distinction affects contract drafting, because the contract should state what data is processed, for what purpose, and under what instructions, in general terms. It also affects oversight, because the entity needs to know whether processing stays within those instructions. A provider that reuses data for its own purposes, or that shares data with a further party outside the agreed chain, creates a data protection issue even if the service itself continues to run smoothly.

Security is the area where the two regimes most visibly overlap, and where confusion is most likely. Both DORA and data protection law care about protecting data and systems, yet they care for different reasons: one focuses on the continuity of financial services, the other on the rights of individuals whose data is processed. A security control may serve both purposes, such as access control or encryption, but evidence for one purpose does not automatically satisfy the other. The entity should therefore ask, for each control, which purpose it serves and what evidence demonstrates it. A single security report may support both assessments, provided its scope covers both the service and the data in question.

Subcontracting and data location illustrate the boundary in practical terms. Under DORA, the entity needs visibility of subcontractors that support its service. Under data protection law, it needs visibility of further parties that process personal data, together with appropriate safeguards where data moves across borders or to new parties. Those two lists may overlap substantially, but they are not identical, since a subcontractor may support a service without touching personal data, and a data handler may process data without affecting service continuity. Keeping both views current, and checking them against each other, avoids a gap where a party appears on one list but is missing from the other.

During an incident, the boundary becomes operational. A security event at a provider may be both a service disruption under DORA and a personal data incident under data protection law, yet the assessments, notifications and remedies for each may differ. The entity needs information from the provider that supports both assessments: what happened to the service, and what happened to the data. Contract terms and incident plans should therefore provide for information sharing that serves both purposes, without assuming that a notification under one regime discharges duties under the other. Clarity before an incident prevents the entity from discovering, under pressure, that its arrangements answer only half the question.