GUIDE · 06 / 8
Data processing addendum (DPA)
Sub-processors · transfers · incidents · audit · security · deletion
WHAT IT IS
The addendum governing the personal information you process on behalf of a customer.
WHEN IT COMES INTO PLAY
As soon as your service touches personal information, which is more and more with every sale.
WHY IT MATTERS
The DPA has become unavoidable: customers ask for it as soon as you process personal information for them, and their compliance teams read it closely. It allocates obligations around security, incidents and sub-processing.
WHAT IT OFTEN CONTAINS
01
Roles of the parties and purposes
Who decides the purposes of processing and who acts on the other's behalf.
02
Security measures
Technical and organizational measures, often described in a schedule.
03
Sub-processors
The list of authorized sub-processors and the procedure to add new ones.
04
Transfers outside the country
The conditions governing disclosure of information outside the country.
05
Incident notice
The timing and content of notice to the customer in case of a privacy incident.
06
Return and deletion of data
What happens to data at the end of the contract: return, deletion and certification.
WHAT OFTEN GETS NEGOTIATED
SAMPLE CLAUSE
INCIDENT NOTICE
« The Supplier shall notify the Customer without undue delay, and no later than seventy-two (72) hours after becoming aware of a privacy incident affecting the Customer's personal information. »
IN PLAIN TERMSIf there's a leak, you notify the customer quickly, within a clear limit, so they can meet their own obligations.
BEFORE YOU SIGN
Are the parties' roles clearly identified?
Do the security measures reflect reality?
Is the sub-processor list up to date?
Is the incident notice deadline realistic?
Is liability capped?
FREE
Personalized negotiation playbook
Share a link to your own contract: we turn it into a starter playbook with opening and fallback positions on the key points. Delivered by email.
Need us to negotiate it for you?