# Data processing agreement

When our work means handling personal data on your behalf — customer records in
a database we migrate, user accounts in a system we run — you are the controller
and we are the processor. Under [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
Article 28 that processing is governed by a written agreement, so we sign one
before the work with the data begins. This page says what it contains.

## Your template or a standard one

If you have a data processing agreement of your own, send it with the brief.
Otherwise two standard texts are written for exactly this relationship: the
European Commission's standard contractual clauses between controllers and
processors (Implementing Decision (EU) 2021/915), and the standard agreement
published by Datatilsynet, the Danish data protection authority, in Danish and
English.

## What we commit to as processor

These are the obligations Article 28 places on every processor, in plain words.
They are the law before they are a promise.

- **Your instructions only.** We process the data on your documented
  instructions, including on any transfer outside the EU and the EEA. If the law
  ever required something else of us, we would tell you before acting, unless
  that law forbids telling you.
- **Confidentiality.** Everyone who works with the data is bound to keep it
  confidential.
- **Security.** We take the measures Article 32 requires. How we build and
  operate systems is on the [security](/security/) page.
- **Rights of the people in the data.** When someone asks to see, correct or
  erase their data, we help you answer, as far as the work allows.
- **Your own obligations.** We help you with security, breach notification and
  any impact assessment, taking into account what we know about the processing.
- **Proof.** We give you the information needed to show these obligations are
  met, and we allow and contribute to audits, including inspections, by you or an
  auditor you appoint.
- **Instructions that break the law.** If we think an instruction infringes data
  protection law, we tell you at once.

## Sub-processors

We engage another processor only with your prior written authorisation, either
for that processor by name or in general. Under a general authorisation we tell
you of any intended addition or replacement first, so you can object. A
sub-processor is bound by the same obligations in a contract of its own, and we
remain responsible to you for its work.

## If personal data is breached

We notify you without undue delay after we become aware of a personal data
breach, with what we know at that point, and we add the rest as we learn it.
That gives you what you need for your own duty to notify the data protection
authority, within 72 hours unless the breach is unlikely to put anyone at risk.

## Less data, not more

We are blunt about data we would rather you did not give us access to. Where a
copy with the personal data removed, or test data, will do the job, we ask for
that instead.

## When the work ends

At the end of the engagement, and at your choice, we delete the personal data or
return it to you, and we delete every copy we hold, unless the law requires us
to keep it.

## What binds us

This page describes the agreement; the agreement is what you sign. Where the
two differ, the signed agreement wins. What this website records about its own
visitors is a different matter, with us as the controller, and is on the
[privacy](/privacy/) page.

Need a DPA in place before work starts?
[send it to us](/contact/) *(your template or a standard one)*.

<https://engineer.company/data-processing/>