GDPR: Application Portfolio Management
The General Data Protection Regulation (GDPR) requires organisations to implement technical and organisational measures to protect personal data of EU data subjects, respond to data subject rights requests, and report breaches within 72 hours.
How GDPR affects ERP managed services
ERP systems hold personal data across HR, customer, and supplier records. A managed services provider with access to the ERP is a Data Processor under GDPR. The Data Processing Agreement (DPA) must specify the scope of processing, sub-processors, data transfer mechanisms, and the provider's obligations on breach notification and subject access request support.
Managed services controls for GDPR compliance
| Control area | Managed services requirement | Evidence type |
|---|---|---|
| Access management | Provider access to production must follow least-privilege principle. Privileged access must be time-limited and logged. | Access logs, PAM tool reports |
| Change management | Every change to production configuration must go through an approved change process with before/after documentation. | Change tickets, approval records |
| Audit trail integrity | The provider must not modify or delete audit log data. Log integrity must be demonstrable (hash or WORM storage). | Log integrity reports |
| Incident response | Security incidents (or potential GDPR breaches) must follow a documented escalation path with defined notification timelines. | Incident records, notification evidence |
| Subcontractor management | If the provider uses subcontractors with access to in-scope data, those relationships must be disclosed and governed. | Subprocessor list, flow-down agreements |
What to include in your managed services contract for GDPR
- A right-to-audit clause allowing your auditors (or external auditors) to review the provider's controls relevant to your environment
- A breach/incident notification SLA aligned to GDPR timelines
- An obligation to maintain SOC 2 Type II certification (or equivalent) and provide reports annually
- A prohibition on using your data to train models or for purposes beyond service delivery
- A data return/deletion clause at contract termination
Ready to assess your ERP managed services options?
Our specialists work with IT directors and finance leads at organisations managing one or more ERP platforms. An assessment takes 45 minutes and produces a written summary you can share with your steering committee.