Third party

A third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data (Art. 4(10) GDPR). Employees of the controller or processor acting within their authority are therefore not third parties, and neither is a processor acting on instructions; a separate controller receiving data, a joint controller, an affiliate company or an external auditor is.

The concept appears at several points in the Regulation. Under Art. 6(1)(f) processing may be based on the legitimate interests of the controller "or by a third party", which allows, for example, a hospital to disclose data in the legitimate interest of a research sponsor. Under Art. 4(9) a recipient may be a third party "or not", so the two concepts must be kept distinct: every third party receiving data is a recipient, but a processor is a recipient without being a third party. Disclosures to third parties must be covered by the information given under Art. 13 and 14 and by a legal basis, and where the third party is in a third country the transfer rules apply.

In clinical research and HealthTech, common third parties include co-sponsors and licensing partners, ethics committees, regulators, insurers, data monitoring committee members, academic collaborators and, for consumer apps, advertising and analytics providers. Informed consent forms and privacy notices often use "third parties" loosely to mean all external recipients including processors; precise drafting that distinguishes processors acting for the sponsor from independent third parties improves transparency and avoids inconsistencies with the RoPA and DPIA.