Obligations and expectations.
WHAT ROLE YOU USUALLY HAVE
Processing data on behalf of your customer, who decides what is collected and why.
WHAT THAT MEANS
Their instructions govern, and you act within them.
WHAT AGREEMENTS TYPICALLY REQUIRE
A written data processing agreement Defined purposes Security commitments Notification of breaches Restrictions on sub-processors Deletion on termination
WHAT A SUB-PROCESSOR IS
Any service you use that touches customer data.
WHAT TO MAINTAIN
A current list of them, published.
WHY
Customers must know, and many agreements require notice of changes.
WHAT TO MINIMISE
Data collected, and how long it is kept.
WHY
What you do not hold cannot be breached, and retention creates obligation.
WHAT TO DEFINE
Retention periods, and automatic deletion.
WHAT TO BUILD
Export of a customer's data, complete Deletion of a customer's data, verifiable
WHY BOTH
They are commonly required, and building them under pressure is worse.
WHAT DATA RESIDENCY MEANS
Where data is physically stored.
WHY IT MATTERS
Some customers and jurisdictions require it to remain in specific places.
WHAT TO ESTABLISH
Your obligations under applicable data protection law. Take advice.
