Processing agreement DPA in English
This is a model of an English-language processing agreement, called Data Processing Agreement (DPA) in English . The DPA Processor Agreement in English contains all provisions that are required under Dutch law under the General Data Protection Regulation (GDPR), including clauses about confidentiality, security, engagement of third parties and liability. Account has also been taken of the obligations arising from the Data Breach Notification Act, which entered into force on 1 January 2016.
When required?
Under the GDPR, a processing agreement is mandatory when one party outsources the processing of personal data to another party. Does your processor engage a sub-processor? This is only allowed with your permission. In that case, you must ensure that the processors enter into a sub-processor agreement with the sub-processor.
Requirements GDPR
The most important requirements that the GDPR sets for a processing agreement in English are the following:
- Personal data may only be collected or processed if there is a good reason to do so. Or if the citizen concerned has given permission for the use of the data;
- No more data may be processed than is strictly necessary for the ultimate purpose;
- The data may not be used for purposes other than those for which it was collected;
- The controller must inform the citizen concerned what he will do with the data;
- The data may not be kept for longer than necessary;
- Appropriate technical and organizational measures must be taken to protect personal data;
- In certain cases, registration of personal data must be reported to the Dutch Data Protection Authority.
Content processor agreement English
Include a clear description in the English processor agreement of the services that the processor provides and the personal data that the processor processes. Attention must be paid to the security of the data and the access to the data. Make sure that agreements are included about the content and frequency of the security reports that the processor provides you. It is advisable to agree that you have the right to have compliance with the security measures determined by independent experts right to be forgotten UK.
Pursuant to the Data Breach Reporting Act, you must include agreements on the content of reports on security incidents and data leaks. Criteria for reporting incidents and the reporting speed must also be recorded. A privacy policy is an internal document. Your company or organization’s policy is aimed at anyone who works with personal data within and on behalf of the organization. This is therefore different from a privacy statement addressed to third parties. This externally directed document in which you provide third parties (customers, website visitors, email recipients) with information about the use of their personal data by your company is often referred to as a privacy statement, privacy statement or privacy notice. With this externally directed document you comply with your legal information obligation.
In practice, the distinction between externally oriented and internally oriented privacy documents is hard to find. A company’s privacy policy is just as easily posted on the website to show how the company handles personal data of customers and website visitors.
