What is a data processing agreement?

A data processing agreement is a contract between a data controller and a data processor, in which the data processor agrees to process data on behalf of the data controller. The agreement sets out the terms and conditions under which the data processor will process the data, and the data controller is responsible for ensuring that the data processor complies with those terms and conditions.

The agreement may also specify the types of data that the data processor is allowed to process, the purposes for which the data may be used, the duration of the agreement, and the rights and obligations of both parties.

‍

When should you offer customers a data processing agreement?

When you are collecting, storing, or processing personal data on behalf of your customers, you should offer them a data processing agreement.

‍

What are popular clauses in a data processing agreement?‍

1. The data processor will only process personal data in accordance with the instructions of the data controller.
2. The data processor will take appropriate technical and organizational measures to protect the personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
3. The data processor will not transfer personal data to any third party without the prior written consent of the data controller.
4. The data processor will make available to the data controller all information necessary to demonstrate compliance with the provisions of this Agreement.
5. The data processor will allow for audits by the data controller or its designated representative to verify compliance with this Agreement.
6. The data processor will promptly notify the data controller if it becomes aware of any personal data breach.7. The data processor will delete or return all personal data to the data controller upon termination of the agreement, unless required to retain such data by applicable law.