Data Processing Agreements
If you’re processing and sharing personal data on behalf of someone else (or if you have others processing data on your behalf), you will need to enter into a Data Processing Agreement (also known as a DPA).
Unfortunately, there isn’t one standard template for this. It’s important to know where your obligations lie and ensure that the processing and sharing purposes are bespoke so that there is no confusion over how to handle the specific dataset. Fortunately, our data protection team are here to help you.
Examples of when a data processing agreement is needed
Onboarding customers to your platform – Customers mayput pressure on your business during the onboarding process and ask youquestions around data when doing their due diligence.
B2B services – Refresh your terms of business toinclude processing clauses to make sure you stay GDPR compliant.
Entering contracts with suppliers – Whether itsgoods or services you’re buying, hardware or software, and however small theamount of personal data being shared and processed might be, you’ll need acontract to cover that. In cases where less data is involved, you can usuallycover your obligations and intentions in a short clause or simple Schedule tothe main agreement.
Who can this affect?
CEOs and Directors – If your business is subject tothe GDPR, to stay compliant, it is in your interest to have a data processingagreement in place. It will make sure that any third party you are using isqualified and capable to handle any data you control.
Founders – You're the brains behind the business,but that also means legal fallout rests with you. Ensure you're keeping up withdata protection obligations with a well drafted data processing agreement.
Sales and marketing – You’ve worked really hard toget those customers through the door, but make sure you understand, or knowwhen to ask legal for help on the implications of the data that is being sharedin this process.