IT service providers and operators
For IT service providers – data protection for many customers, cleanly separated
IT service providers and operators process personal data on behalf of their customers. They have to delete when the customer requests it, support them with requests and prove what has happened. Espresso is multi-tenant: several customers in one installation, cleanly separated from one another – also as an offering for your own customers.
What makes it challenging for IT service providers
Many clients
Every customer has its own retention periods, systems and contacts.
Deletion at the end of the contract
Once the engagement ends, the data must be deleted or returned – demonstrably.
Support with requests
Customers expect help when data subjects request access or erasure.
Proof for clients
Customer audits and inspections demand evidence rather than assurances.
How IT service providers use Espresso
- Data Deletion Deletion on behalf of customers Orchestrate deletions across the systems you operate and provide each client with a log. Go to the module
- Subject Request Requests for your customers Handle access and erasure requests per customer, with deadlines and an audit trail. Go to the module
- Privacy Register Systems and retention periods per customer Keep systems, locations of personal data and retention periods separate for each client. Go to the module
- Data Discovery Customer data in your own storage Find where your clients' data is stored in file storage, databases and mailboxes. Go to the module
The framework for processors
Anyone processing on behalf of others has their own obligations – under the law and towards the client.
| Rule | What it means |
|---|---|
| Processing on behalf | Processing only in the way the client itself would be permitted to; sub-processors only with the client's authorisation (Art. 9 FADP, Art. 28 GDPR). |
| Register | Processors also keep a record of their processing activities (Art. 12 FADP, Art. 30 para. 2 GDPR) – with the same exemptions for smaller companies. |
| End of contract | Under the GDPR, the data must be deleted or returned once the services have been completed (Art. 28 para. 3 let. g GDPR). |
| Support with requests | The processor assists the controller in responding to requests from data subjects (Art. 28 para. 3 let. e GDPR). |
| Breach notification | The processor reports data security breaches to the controller as soon as possible (Art. 24 para. 3 FADP). |
Overview without any claim to completeness; does not replace legal advice in individual cases. As of: 6 October 2026.
Getting started
Operate Espresso for your customers
As an operating partner, you offer Espresso to your own customers – in your data centre, multi-tenant and with our support.
Frequently asked questions
Can we operate several customers in one installation?
Yes. Espresso is multi-tenant: several companies, brands or customers work in one installation, cleanly separated from one another.
Can we offer Espresso to our customers?
Yes, as an operating partner. The partner page shows what the collaboration looks like.
Who can see a customer's data?
Roles per module determine who may do what; tenants' data is kept separate, and every action is recorded in the audit trail.
How do we prove a deletion to the client?
With the log for each deletion run and the reports from Data Deletion – every response from the applications is recorded.
Related topics
- Delete Deletion log and proof of deletion What a proof of deletion should contain and why a spreadsheet is not enough. Read more
- Fundamentals Running data protection software yourself Why data protection software often needs to run in your own data centre or your own cloud. Read more
- Requests Right to erasure When personal data must be deleted on request, which exceptions apply and how to prove the deletion. Read more
See Espresso in 30 minutes
We will show you the cockpit with sample data – and discuss where you should start.
Request a demoor write directly to info@espressodataprivacy.com