A payroll provider or cloud platform may receive employee and customer data as part of an ordinary service. Before signing, identify who decides why the data is used and what the supplier will actually do. A confidentiality clause alone does not answer these questions.
Start with the service and the data
Ask the business owner to describe the workflow in plain language. Prepare an annex listing the service, data fields, individuals concerned, storage locations and people with access. Avoid attaching live customer records merely to illustrate the arrangement.
Check the legal role
Under Albania’s Law No. 124/2024, Article 26 addresses processing on a controller’s behalf. It requires a binding written framework describing the processing and including protections concerning instructions, confidentiality, security, assistance, audit and return or deletion. Subprocessors require prior written authorisation.
The contract label should match the real operation. If the supplier decides its own purposes, the role needs separate analysis. International access or storage also calls for a transfer review; a processing agreement alone does not settle that issue.
Turn the annex into an operational document
For each service, name a contact who can approve instructions and a backup contact. Record how requests will be submitted, acknowledged and tracked. Specify what happens when the scope changes, rather than relying on a general promise to cooperate.
Ask for evidence
Request an understandable account of access controls, backup practices, incident escalation and the supplier chain. Review whether the proposed audit arrangements let you obtain meaningful evidence. A long questionnaire is less useful than answers tied to the actual service.
Plan the exit before onboarding
Agree the export format, transition support, responsible contact and method for confirming completion. Separate business records that must be retained from data that should leave the supplier’s active systems. Test whether the proposed timetable works for the business.
A practical approval checklist
Before approval, confirm that the annex matches the commercial scope, the operational contacts have reviewed it, security questions are answered and open issues have an owner. Keep the agreed version with the main service contract and revisit it when the service changes.
How Alba Legal can help
Alba Legal can review the service agreement and its data annex together, identify gaps and help the business document workable supplier obligations. This article gives general information, not advice for a specific processing operation.
Official source: Law No. 124/2024 on Personal Data Protection, particularly Article 26.
