Zansa › Answers › Privacy, security and ownership
What is a data processing agreement and when do I need one?
A data processing agreement is a contract between a data controller and a processor, also called an operator in POPIA, that governs how the provider handles personal data on your behalf. You generally need one whenever an outside party processes personal data for you. This is general information, not legal advice.
GDPR requires such a contract between controller and processor. POPIA expects a written contract with operators. Typical contents include the subject and duration, types of data, instructions, confidentiality, security measures, help with data subject requests, breach notification and return or deletion at the end.
Use a template reviewed by a qualified adviser, and sign it before any data is shared. Rules differ by country and sector, so check how this applies to you with a qualified adviser.
Want this applied to your business? Zansa builds dashboards and forecasts for small and mid-sized companies worldwide. Start with a free intro call.
Book a call