Data processing agreement (DPA)
The contract required by Art. 28 GDPR between controller and processor: which data, for what and with which guarantees.
A data processing agreement (DPA) is the written agreement between the controller and the processor. Art. 28 of the GDPR requires one whenever a supplier processes personal data on someone else’s behalf.
- Subject matter, duration, nature and purpose of the processing.
- Type of data and categories of people concerned.
- That the processor acts only on instructions and with confidentiality.
- Security measures and breach notification.
- Rules for sub-processors.
- What happens to the data at the end: return or deletion.
Many suppliers include it in their terms or publish it on their website so it doesn’t need negotiating case by case. Before using a tool with your company’s data, ask for or look up this document.
Echo’s is published as the data processing agreement (in Spanish) and applies to companies using Echo with third parties’ data. If you need anything else, get in touch via contact. This is general information, not legal advice.
