Data Processing Agreement: Who Controls the Data and What the Processor Must Do

When one organisation handles personal data on behalf of another, data protection law in most jurisdictions requires the arrangement to be governed by a written contract with specified content. That contract is the data processing agreement. It is not a formality invented by lawyers: it is the mechanism by which obligations towards individuals follow their data into a supplier's systems.

For a buyer of business software, this is now a routine part of procurement. Almost any system holding customer records, employee details or contact information involves a processing relationship, and a supplier without a standard agreement to offer is unusual.

The controller decides why and how personal data is processed. The processor does it on the controller's instructions. In a straightforward software purchase, the customer is the controller of the records it uploads and the vendor is the processor.

The complication is that most relationships involve more than one data set. A vendor is typically a processor for the customer data you upload and a controller for the account, billing and usage data it collects about your organisation, because it decides those purposes itself. A well-drafted agreement acknowledges both roles rather than describing the whole relationship in one direction. Where a supplier begins determining purposes for data you provided, for example by using it for its own analysis, it may become a controller for that activity whatever the contract calls it.

Sub-processors

Data entrusted to one supplier is frequently handled by several. Hosting, messaging, analytics and support tooling all touch it. The reasonable arrangement is a maintained list, advance notice of additions and a right to object. A clause allowing unlimited additions with no notice removes any ability to assess who holds your data, which is the specific thing a security review is for.

Breach notification

Controllers usually face a short statutory deadline to notify a regulator after becoming aware of a breach. A processor commitment to notify without undue delay, with no period stated, can leave the controller unable to meet that deadline through no fault of its own. Ask for a defined maximum period and a list of the information that will accompany the notification.

Deletion and exit

Deletion or return at the end of the contract is a required term everywhere, and the difference between a real commitment and a nominal one lies in the detail. Which format is data returned in, and can it be loaded into another system. Within what period does deletion occur, and is confirmation provided. How long do residual copies persist in backups before their retention cycle expires. A supplier that answers the last question honestly is being accurate; one that claims instant and total deletion including backups is usually not.

Moving personal data across borders generally requires a lawful basis. Under the European framework, the common routes are an adequacy decision covering the destination country and standard contractual clauses agreed between the parties, sometimes with an assessment of the destination's legal environment. The practical questions for a buyer are simpler: where is the data stored, where is it processed, which functions move it elsewhere, and can a region be chosen.

Requirements differ by jurisdiction, and a business operating in several should not assume one approach satisfies all of them. India's framework, which uses data fiduciary and data processor in place of controller and processor, likewise requires a contract to be in place before a processor handles data on a fiduciary's behalf. Nothing on this page is legal advice, and data protection is an area where the general shape is easy to describe and the specific application is not.

A security review assesses whether a supplier's practices are adequate, while the data processing agreement is the contractual expression of what it must do. A master service agreement is the framework the processing agreement usually attaches to. A sub-processor list is the operational document that supports the sub-processor clause. Standard contractual clauses are one of the transfer mechanisms rather than a substitute for the agreement itself.

Related pages on evaluating, buying and running a CRM:features overview, what a CRM is, CRM in India, book a demo, compare alternatives, and pricing.