Do I need a data processing agreement?

If a company is to allow another company to process personal data on its behalf, it must enter into a data processing agreement (DPA). For instance, you need a DPA if you outsource operations of your IT systems, if an HR company takes over your personnel services, or if you use a cloud service for invoicing your customers. The company you outsource the processing to is called a data processor. The DPA is your documentation that you have given and are entitled to give instructions to the data processor. It must also ensure that the processing takes place in accordance with the privacy regulations. 

If you need help setting up or reviewing a DPA, you can contact us here.