Data processing agreement

This document is not published yet.

We would rather say that than put up something that reads like a policy and is not one. A document like this has to be written by a solicitor: it is enforceable, and getting it wrong is worse than not having it.

Who asks for it

The enterprise gate. No serious buyer proceeds without one they can sign.

What it has to cover

Controller and processor roles, and the subject matter and duration of processing.
The Article 28 obligations, in full.
Sub-processor authorisation and the notice period for a change.
The transfer mechanism, and the assessment behind it.
Audit rights, and what they practically mean for a company this size.
Breach notification timing.

If this is blocking a decision, say so on the quote form. Meanwhile our sub-processors are listed in full, because that is a matter of fact rather than a legal opinion.