Hosting and data
What is a data processing agreement and when do you need one?
Short answer
A data processing agreement is a contract between your organisation and a supplier that handles personal data on your behalf, such as a host, a payroll provider or an IT administrator. The GDPR requires it in Article 28. It sets out what the supplier may do with the data, how it protects it, which other parties it uses and what happens after a data breach or when the contract ends.
When is someone a processor?
When they handle personal data for you, on your instructions and for your purpose. You decide what happens; the supplier carries it out.
Personal data is broader than many people think. A name with an email address already counts. A customer file, a personnel file, a mailbox, a list of orders: all personal data.
| Supplier | Usually a processor? |
|---|---|
| Hosting company where your website or mail runs | Yes |
| IT administrator with access to your systems | Yes |
| Payroll provider | Yes |
| Supplier of cloud bookkeeping or CRM software | Yes |
| Newsletter tool | Yes |
| Lawyer, notary, company doctor | No, they decide for themselves how to work |
| Postal service or bank | No |
If you are unsure, ask: who decides what the data is used for? If it is you, the other party is a processor.
What must it contain?
The GDPR prescribes the subjects. In plain language:
- What and why. Which data, of whom, for what purpose and for how long.
- Only on instruction. The supplier does nothing with the data other than what you instruct.
- Confidentiality. The supplier’s staff who can access it are bound to secrecy.
- Security. Which measures the supplier takes. The more concrete, the better.
- Sub-processors. Whom the supplier uses and how you are informed about it.
- Help with requests. If someone asks for access or deletion, the supplier helps you to comply.
- Data breaches. The supplier reports a breach to you, so that you can assess in time whether you have to report it.
- End of the contract. The data is returned or deleted.
- Audit. You may check whether the supplier keeps to the agreements.
What do you check when you receive one?
Most suppliers send their own standard version. It is seldom unreasonable, but check four things.
Where is the data? It should name a country, preferably a place. “In the cloud” or “within the EEA where possible” is not an answer. Why that matters is explained in where is your data.
Who are the sub-processors? A list with names and countries. If an American company is among them, it falls under American law, even if the servers are in Europe.
How soon do you hear about a data breach? You have no later than 72 hours after discovering it to report to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). So the supplier must inform you well before that. “Without undue delay” is the legal formula; a concrete deadline is better.
What happens when you leave? Do you get your data back, in what format, and is it deleted afterwards? This is the clause you only think of when it is too late.
What is often missing?
At organisations where we take over management, we see three things.
There is no overview of suppliers. Nobody knows with whom there are agreements. A list of all parties that can reach personal data is the start, and it also belongs in the record of processing activities that the GDPR requires of you.
The agreement was signed and never looked at again. Since then the supplier has moved to another cloud, with other sub-processors. Without an agreement on changes, you do not know that.
The old supplier still has everything. The contract was cancelled, the data was never deleted and the access was never withdrawn.
How do we do it?
For everything we host or manage for clients, we are the processor and we sign a data processing agreement. It states where the data is, namely on our own hardware in a data centre in Hengelo, and which parties we use. More on the location is under Dutch cloud.
We are not lawyers. For the assessment of an agreement with another supplier, or for a special situation such as medical data, a lawyer or your data protection officer should look at it too.