Your Third-Party Dossier: When External Services Process Personal Data

You share more data than you think

Ask yourself: how many external parties have access to personal data from your customers, employees, or website visitors? Most business owners guess three or four. In reality, the average SME shares data with 10 to 30 parties.

Your accountant sees customer details. Your email tool processes email addresses. Your CRM stores contact history. Your website sends data to Google Analytics. Your hosting provider has access to server logs. And that’s before considering your occupational health service, insurer, or invoicing tool.

Under the GDPR, you are responsible for what all those parties do with the data. That starts with knowing who they are.

The scan gets you started

The GDPRWise scan automatically discovers third parties that have an integration with your website. CRM tools, social media integrations, form providers, advertising platforms, analytics services, chat widgets - if they connect to your site, the scan picks them up and adds them to your third-party dossier.

This gives you a solid starting point. But not all third parties are connected to your website. Your accountant, insurer, or occupational health service won’t show up in a website scan. To help you find those, think in four categories and check each one for completeness.

Four categories to check for completeness

1. Professional service providers

Parties you hire for specific tasks that involve personal data:

• Accountant - sees financial records, payslips, VAT numbers
• Lawyer or legal adviser - receives case files in disputes
• Occupational health service - processes employee health data
• Insurer - receives personnel and business data

2. Online tools and software

The digital tools you use daily that store or process data:

• CRM system - customer data, contact history, notes
• Email tool - email addresses, open and click behaviour, lists
• Accounting software - invoice data, customer and supplier details
• Project management - task descriptions, team communication
• Cloud storage - documents, files, backups

3. Social media and advertising

Platforms where you share data, often without realising it:

• Facebook and Instagram - pixels, custom audiences, lead forms
• LinkedIn - company page analytics, ad targeting
• Google Ads - conversion tracking, remarketing, keyword data
• TikTok and YouTube - pixels, analytics, ad campaigns

4. Hosting and infrastructure

The technical foundation your business runs on:

• Web hosting provider - server logs, IP addresses, email traffic
• IT administrator - access to systems and data

GDPRWise generates your processing agreements

For every third party that processes personal data on your behalf, you need a data processing agreement (DPA). This is a legal requirement. GDPRWise makes it simple: the platform automatically generates a professional DPA you can send directly to the party in question.

Each generated agreement covers all mandatory elements:

• Which data is processed
• The purpose of the processing
• The security measures expected
• What happens when the relationship ends

Many major software vendors already have their own DPA. GDPRWise also helps you request and register those in your dossier.

Build your dossier step by step

You don’t need to map all third parties at once. Work category by category:

1. Start with your online tools - check your email tool, CRM, and accounting software to note which parties they are
2. Add your professional service providers - accountant, lawyer, occupational health service
3. Check your website - GDPRWise automatically detects many external scripts and tools
4. Don’t forget hosting - your web host and IT administrator almost always process data

For each party, record which data they process, why, and whether you already have a DPA. GDPRWise tracks which agreements are still missing and sends you reminders.

It’s not complicated and it doesn’t have to be done all at once. The most important thing is to start.