Data processing agreement
DPA · The written contract between a data controller and a processor that sets out for what purpose, with what security measures and under what conditions personal data will be processed.
- 01
Why it matters
The GDPR explicitly requires this contract; under KVKK too, it is the most concrete way for the controller to make sure the processor takes security measures. The contract covers processing on instructions, confidentiality, sub-processors, breach notification and returning or deleting the data at the end of the contract.
- 02
Example
When choosing new customer support software, a company reviews the provider's data processing agreement, learns in which country the data is stored and which sub-processors are used, and then signs it.
- 03
Common mistake
Accepting the provider's standard agreement without reading it. Which country the data goes to and who the sub-processors are directly affect international transfer obligations.
- 04
Let's talk about your project.
Tell us what you need; we will define the scope together.