The travel agencies services for the employees of other company

Your company is the data controller of your employees’ data because your company determines the purposes and means of data processing (Which data? Transferred to whom? Why? What security measures have been taken?).In fact, according to Article 4 GDPR, the data controller is “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data” while the data processor “processes personal data on behalf of the controller”.Therefore, your company selects the winning travel agency and transfers employees’ data, while the travel agency will process those data on your behalf by organizing the travels for your employees.

Here you can find some useful information:EU GDPR controller vs. processor – What are the differences? https://advisera.com/eugdpracademy/knowledgebase/eu-gdpr-controller-vs-processor-what-are-the-differences/

In case of need, here you can find our template of data processor agreement for suppliers:Supplier Data Processing Agreement https://advisera.com/eugdpracademy/documentation/supplier-data-processing-agreement/

You can also consider enrolling in this free online training EU GDPR Foundations course: https://advisera.com/training/eu-gdpr-foundations-course//