Term
Data processing agreement: what the term means
The written contract UK GDPR requires whenever a controller uses a processor to handle personal data on its behalf.
The written contract UK GDPR requires whenever a controller uses a processor to handle personal data on its behalf.
Data processing agreement in practice
When a business uses a supplier to process personal data for it, for example a software provider, payroll bureau or marketing agency, UK GDPR requires a written contract setting out the subject matter, duration, nature and purpose of the processing, the types of data and data subjects, and specific obligations on the processor.
Those obligations include acting only on documented instructions, confidentiality, security, using sub-processors only with authorisation, assisting with individuals' rights and breaches, and deleting or returning data at the end. The Information Commissioner's Office publishes a checklist.
Source: ico.org.uk