This page describes our approach to a Data Processing Addendum when personal data is processed on behalf of a client.
When a DPA applies
If an engagement involves processing personal data as a processor for the client (controller), parties execute a DPA (or equivalent clauses) covering:
- subject matter and duration;
- nature and purpose of processing;
- types of personal data and data subjects;
- obligations of processor and controller;
- subprocessors;
- international transfers;
- security measures;
- deletion or return of data at end of services.
Request a DPA
Email [email protected] with the project reference. The final DPA text is agreed per engagement and jurisdiction.