{"id":542,"date":"2017-11-21T14:01:47","date_gmt":"2017-11-21T14:01:47","guid":{"rendered":"https:\/\/www.securecloudaas.com\/?p=542"},"modified":"2019-11-08T15:03:49","modified_gmt":"2019-11-08T15:03:49","slug":"is-your-data-processing-agreement-ready-for-the-gdpr","status":"publish","type":"post","link":"https:\/\/www.securecloudaas.com\/is-your-data-processing-agreement-ready-for-the-gdpr\/","title":{"rendered":"Is your data processing agreement ready for the GDPR?"},"content":{"rendered":"\n
\"\"\/<\/figure><\/div>\n\n\n\n

From May 25 2018 any business in the European union or EEA that processes personal data has to comply with the GDPR. With the GDPR come changes that also affect the data processing agreement. But what exactly are these changes to the processing agreement? And how do they affect existing agreements with your suppliers?<\/p>\n\n\n\n

Data processing agreement<\/h4>\n\n\n\n

A data processing agreement (DPA) establishes how a processor is to handle personal data. It is an agreement between the controller of the personal data and the party processing the personal data for them. Cloud service providers are generally data processors.<\/p>\n\n\n\n

In a data processing agreement, things such as the purpose of the data processing are recorded. The DPA also includes the kind of personal data that will be processed. When a processor processes personal data for a controller, the person legally responsible, a data processing agreement between both parties is mandatory.<\/p>\n\n\n\n

Controller<\/h4>\n\n\n\n

The controller determines the purpose and means of the data processing. When your business processes employees\u2019 personal data, a salary slip is a good example. The business is then responsible for this data.<\/p>\n\n\n\n

\"\"\/<\/figure><\/div>\n\n\n\n

Processor<\/h4>\n\n\n\n

The processor works with the personal data on behalf of the controller. For example the payroll office that pays out the salaries for your company.<\/p>\n\n\n\n

The controller and the processor have to make agreements about the processing, because both parties are obliged to have such an agreement as part of their documentation. The data processing agreement is free of format, to make it possible for you to include it in your own General Terms and Conditions. Do make sure that your General Terms and Conditions are applicable and binding. Most of the time a separate agreement is drawn up to have all the provisions grouped together.<\/p>\n\n\n\n

Data processing agreement contents<\/h4>\n\n\n\n

A data processing agreement has to state which data processes it concerns. Is also has to include which parties are involved in the processing of certain personal data. It is advisable include in the data processing agreement who is responsible for reporting any data breaches. Wonder what else that should be in a data processing agreement? Or if your processing agreement is ready for the GDPR? What should definitely be in the processing agreement is in this checklist:<\/p>\n\n\n\n