Data processing agreement

A data processing agreement is a written contract between a company and a provider that handles personal data on the company's behalf. It is required by GDPR article 28. The company is called the data controller. The provider is called the data processor. In English it is often shortened to DPA.

When do you need one?

You need a data processing agreement every time a provider stores, reads or handles personal data for you. Typical examples are:

• A hosting provider that runs your servers.
• A consultant who has access to your databases.
• A cloud service for mail, backup or support.

If your Domino servers hold names, mail or customer data, and someone else runs them, you need an agreement.

What must it contain?

GDPR sets out what the agreement must say. Among other things:

• What the provider may do with the data, and that it only acts on your instructions.
• That staff with access are bound by confidentiality.
• How the data is secured.
• Which other providers, called sub processors, help out, and that you must approve them.
• That the provider helps you when people ask about their data, and when there is a breach.
• What happens to the data when the agreement ends: returned or deleted.
• That you may check that the rules are kept.

Data processing agreements and Domino hosting

When you choose Domino hosting, the provider becomes your data processor. Ask for the agreement before you sign the main contract. Check where the data and the backup live, and which sub processors are involved. Read more in our guide on what to demand of Domino hosting.

Why does it matter?

Without an agreement you break GDPR, even if nothing goes wrong. And if something does go wrong, the agreement shows who must do what. It protects both you and the people whose data you hold. Logging who reads personal data, for example with GDPR Logger, makes it easier to live up to the rules in practice.