When we host, operate, integrate or develop solutions for you, we often process personal data on your behalf – about your customers, employees or others. In that case you are the data controller, and we are the data processor. This requires a data processing agreement under Article 28 of the General Data Protection Regulation (GDPR).
Our standard agreement
We use a data processing agreement that follows the template of the Danish Data Protection Agency. It consists of a fixed part and four appendices, which are completed for the specific task.
The fixed part describes that we
- only process the data on your documented instructions,
- ensure that only authorised employees bound by confidentiality have access,
- implement the technical and organisational security measures that the processing requires,
- only use sub-processors with your approval and on the same terms as those we are subject to ourselves,
- do not transfer data to countries outside the EU without your instructions,
- assist you when data subjects exercise their rights, and when you have to notify a personal data breach,
- notify you without undue delay if a personal data breach occurs,
- erase or return the data when the cooperation ends,
- give you the information you need for supervision and audits.
The appendices describe the specific processing:
| Appendix | Contents |
|---|---|
| A | Purpose, types of personal data, categories of data subjects and duration of the processing |
| B | Conditions for the use of sub-processors and the list of approved sub-processors |
| C | Instructions, level of security, locations of the processing and procedure for supervision |
| D | Other matters, e.g. payment for assistance and supervision |
What to do
- Would you like to use our standard agreement? Write to info@datalogik.dk, and we will send it to you, completed with what we know about the task.
- Do you have your own template? That is perfectly fine. Send it to us, and we will review and sign it if it covers the same.
If you have questions about how we look after your data, get in touch with us. It is part of what we advise on every day.