Is your MSP a data processor? The question to ask, and the facts we give you to answer it

Access and processing are not the same thing

The ICO's definitions are short. A controller determines the purposes and means of the processing of personal data. A processor processes personal data on behalf of the controller, acting under the controller's authority and on its instructions. Everything turns on that phrase, on behalf of. A processor is engaged to do something with the data for you.

An operations provider is engaged to do something with the infrastructure. We deploy agents, tune monitors, patch servers, review access, run the on-call rota and respond when something breaks. None of that requires us to open the table that holds your customers' records, and a well-designed engagement makes sure we cannot do so casually. The credential can technically reach the database. The service does not involve reading it. Whether that makes the provider a processor is a determination for your data protection lead, on the facts, and the honest position for a provider is to give them the facts rather than the answer.

The five questions to put to any provider

1. What personal data does the service require you to access, store or process on our behalf? The honest answer for an operations provider is usually "none by design, and here is the design". If the answer is "we might see some in logs", that is a real answer, and it leads to the next question about logs.
2. What personal data do you hold about us for your own purposes? Staff names, business email addresses and phone numbers in a CRM, almost always. That makes the provider a controller of that data, which is a different question with a different answer.
3. What stops your staff seeing data they do not need? Least-privilege roles, no standing access to data planes, sensitive-data redaction in any logs that reach the provider's tooling, and an audit trail of what was accessed. Ask to see them.
4. What agreement covers processing if it does occur, and where does it sit? If the data processing terms are already inside the master agreement, they apply the moment processing happens, without a second negotiation. That is simpler for both sides than a standalone agreement nobody can find later.
5. What backs those answers up? Certifications are the start, not the end. ISO 27001 says a management system exists. Cyber Essentials Plus says technical controls were independently tested. The evidence that matters is the access review, the redaction configuration and the last tabletop exercise.

The logs question, because it always comes next

The place an operations provider is most likely to encounter personal data is not the database. It is the log line that copied a record out of the database because a developer was debugging. If your provider runs your observability platform, ask what they do about that. The answer should include sensitive-data detection and redaction at ingest, retention set per source, and a way to show it ran. We wrote about this separately in logs as a data-protection surface, because it is the gap we find most often.

How we answer

In writing, in the due-diligence pack, before the call if we can. Our services operate infrastructure and observability; they do not require us to access, store or process your customers' or users' personal data, and we design the access so that is the case rather than hoping it is. The personal data we hold about you is your staff's business contact details, for which we are the controller. Our data processing terms sit inside the master services agreement, so they apply if processing does occur, with no separate document to chase. The ISO 27001 and Cyber Essentials Plus certificates, the sub-processor list and the incident process are in the pack.

Your data protection lead makes the determination. We are not advisers on data protection law and we do not pretend to be. What we can do is give them a set of facts that are specific enough to decide on, and controls they can inspect rather than take on trust. That tends to be a shorter call.

Where we fit

Critical Cloud runs production for organisations whose data would make the news if it leaked: healthcare research, financial services, payments, the public sector. We operate and evidence the runtime controls that support your obligations, and the processor question is one of the first places that evidence gets asked for. The security and compliance page sets out the framework, and the sector pages set out what each regime tends to ask.

Sources

• ICO, What are controllers and processors? The definitions quoted are the ICO's. The page notes the guidance is under review.
• The opening scenario is a composite of conversations we have had with customers' data protection leads. No customer is identified.