Contracts with your processors.
WHAT THEY ARE
Written arrangements governing how a processor handles data for a controller.
WHEN THEY ARE REQUIRED
Whenever a processor handles personal data on your behalf.
WHO YOU USE AS PROCESSORS
Hosting providers Email services Analytics tools Payment providers, sometimes Customer support platforms Anyone storing or handling your data
WHAT THE AGREEMENT SHOULD COVER
The subject matter and duration The nature and purpose The categories of data and data subjects That processing occurs only on documented instructions Confidentiality obligations on staff Security measures Rules about sub-processors Assistance with rights requests Breach notification Deletion or return at the end Audit rights
WHAT TO CHECK ABOUT SUB-PROCESSORS
Whether you are notified of changes, and whether you may object.
WHAT TO MAINTAIN
A list of every processor you use.
WHY
You cannot govern what you have not listed.
WHAT TO DO WHEN YOU ARE THE PROCESSOR
Expect customers to require the same of you.
WHAT TO PREPARE
A standard agreement you can offer.
WHY
It shortens sales cycles substantially.
WHAT TO NEVER SIGN
Obligations you cannot meet.
