Data processing agreement

When our work means handling personal data on your behalf — customer records in a database we migrate, user accounts in a system we run — you are the controller and we are the processor. Under GDPR Article 28 that processing is governed by a written agreement, so we sign one before the work with the data begins. This page says what it contains.

Your template or a standard one

If you have a data processing agreement of your own, send it with the brief. Otherwise two standard texts are written for exactly this relationship: the European Commission’s standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915), and the standard agreement published by Datatilsynet, the Danish data protection authority, in Danish and English.

What we commit to as processor

These are the obligations Article 28 places on every processor, in plain words. They are the law before they are a promise.

• Your instructions only. We process the data on your documented instructions, including on any transfer outside the EU and the EEA. If the law ever required something else of us, we would tell you before acting, unless that law forbids telling you.
• Confidentiality. Everyone who works with the data is bound to keep it confidential.
• Security. We take the measures Article 32 requires. How we build and operate systems is on the security page.
• Rights of the people in the data. When someone asks to see, correct or erase their data, we help you answer, as far as the work allows.
• Your own obligations. We help you with security, breach notification and any impact assessment, taking into account what we know about the processing.
• Proof. We give you the information needed to show these obligations are met, and we allow and contribute to audits, including inspections, by you or an auditor you appoint.
• Instructions that break the law. If we think an instruction infringes data protection law, we tell you at once.

Sub-processors

We engage another processor only with your prior written authorisation, either for that processor by name or in general. Under a general authorisation we tell you of any intended addition or replacement first, so you can object. A sub-processor is bound by the same obligations in a contract of its own, and we remain responsible to you for its work.

If personal data is breached

We notify you without undue delay after we become aware of a personal data breach, with what we know at that point, and we add the rest as we learn it. That gives you what you need for your own duty to notify the data protection authority, within 72 hours unless the breach is unlikely to put anyone at risk.

Less data, not more

We are blunt about data we would rather you did not give us access to. Where a copy with the personal data removed, or test data, will do the job, we ask for that instead.

When the work ends

At the end of the engagement, and at your choice, we delete the personal data or return it to you, and we delete every copy we hold, unless the law requires us to keep it.

What binds us

This page describes the agreement; the agreement is what you sign. Where the two differ, the signed agreement wins. What this website records about its own visitors is a different matter, with us as the controller, and is on the privacy page.

Need a DPA in place before work starts? send it to us.