Generate a DPA for a customer
Compose an Article 28 data processing agreement for a controller you process data for, then file the signed copy.
When you process personal data for a customer, you're its processor and the customer is the controller. The Customer DPAs section, under the vendors on the Sub-processors tab, records those controllers and the GDPR Article 28 agreement with each, and can compose that agreement for you.
Generate a DPA
- Select Generate DPA.
- In Generate a customer DPA, fill in the Customer (Customer legal name, Trading name, Website, Customer jurisdiction), the Service you provide (Description of processing, which the agreement sets out as the subject-matter and nature of the processing), Data transfer & safeguards (Where you process the data, Transfer mechanism, Supplementary measures) and the Term (Signed on, Term, Auto-renewal).
- Select Generate DPA.
The agreement is composed from your answers and filed as a PDF against the record. It's also listed in your Documents as a Customer DPA.
What the agreement contains
The PDF is titled Data Processing Agreement under GDPR Article 28. It names your company as processor, by its legal details from Settings › Organization, sets out the particulars you entered and the transfer safeguard you chose, and covers the eight things Article 28(3) says the contract must stipulate. The processor:
- processes the data only on the controller's documented instructions;
- ensures the people processing it are bound to confidentiality;
- takes the security measures Article 32 requires;
- respects the conditions for engaging another processor;
- assists the controller with data subject requests;
- assists the controller with Articles 32 to 36;
- deletes or returns the data at the end of the service, at the controller's choice;
- makes available the information needed to demonstrate compliance, and allows audits.
The draft gives you general written authorisation to engage other processors, with notice to the controller in advance and a right to object. It's a working draft for both parties to review and sign, not an official form. Where a transfer relies on the Commission's standard contractual clauses, the draft records them as the safeguard, and they're executed separately.
After it's signed
Download the draft from the record at any time. Once both parties have signed, select Replace beside the file on the record to file the executed copy; it takes the draft's place, so the record has one file. Edit details changes the record, never the filed copy. Renew now and Mark superseded work as they do for vendors; see Keep your sub-processor register.