Handing another organisation access to your customer, product or financial data is the part of outsourcing that keeps owners awake, and the risk is usually not the dramatic one people imagine. The common failures are mundane: an account that stayed active after a project ended, a spreadsheet that left the building containing three times more columns than the task needed, a process nobody could restart because it lived in one person’s memory.

Here is what to settle before the first file moves.

1. Minimise what you hand over

The cheapest control is not sending data at all. Ask what the task genuinely needs. If a job needs 400 rows and six columns, do not export the table. If real customer records are not required for a test batch, use a masked or synthetic set. Data minimisation reduces risk without any negotiation at all, and it is the first question a good supplier should be asking you.

2. Access: named accounts, least privilege, revocable

  • Named individual accounts, never shared logins. Shared credentials make it impossible to say who did what, and they outlive the person who used them.
  • Least privilege — read-only where writing is not needed, and only the systems the task touches.
  • Multi-factor authentication on anything that reaches customer or financial data.
  • A written access list — who has what, why, and when it ends. Review it at each project change rather than at contract start only.

Agree the removal step before it is needed, and put it on a calendar with a named owner on your side. Revoking access is the single most commonly missed task in any engagement.

3. Say what happens to the data, in both directions

Three questions should have written answers in the agreement, not the sales call:

  1. Where is it processed? Which country, and by whom. If work is distributed, ask what “our team” means.
  2. What may it be used for? Only your work, or anything else. Say no to anything that does not have a purpose.
  3. When is it destroyed or returned? In what form, and how do you get confirmation?

4. International transfers

For UK businesses, sending personal data outside the UK engages UK GDPR transfer rules. The usual routes are the UK Addendum to the EU standard contractual clauses, or a UK trade agreement where it applies. In practice this means a documented basis for the transfer and a processing agreement between you and the supplier covering purpose, security measures, sub-processing and assistance with data-subject requests.

None of this should be intimidating, and none of it is unusual for a supplier who does this regularly. A supplier who cannot answer plainly where work happens and on what basis is telling you something useful about their maturity.

For a straightforward view of your own obligations as a controller, the Information Commissioner’s guidance at ico.org.uk is the reference worth reading before a conversation with any supplier.

5. The practical layer people forget

  • Devices — full-disk encryption, screen lock, and whether personal devices are allowed at all.
  • Local copies — downloads and email attachments are where data escapes. Ask whether working files stay in the agreed system.
  • Chat and email — sensitive fields in a messaging thread are still a copy of that field.

6. Incident reality

Assume something will eventually go wrong, and decide in advance what happens. Who tells whom, within what period, and who handles the customer or regulator notification. A breach disclosure duty can attach to you even when the failure was on someone else’s watch, so a supplier who says “we will let you know if anything happens” has left the important part out.

7. Keep the exit in scope from day one

Return of files in a usable format, deletion with confirmation, access removal, and handover of anything documented during the engagement. Cost is never the obstacle here; the obstacle is that nobody owns the task once the commercial relationship stops being interesting.

How we handle it

NexGen eHub Limited is registered in England and Wales and manages delivery from the UK. Back-office delivery may involve external specialists, which is disclosed in our terms of business. Where work is performed outside the UK, that is stated rather than glossed over. What we collect through the website is described in the privacy notice, your rights and how to exercise them in our data protection page, and how the site itself stores almost nothing in the cookie notice. The handling steps above are the same ones behind our data entry and management service, so ask us, before you commit, for the specific arrangements for the data you would send.