Data protection and ongoing operations
Do we need a data processing agreement?
Answer
As soon as we process personal data on your behalf — customer data in an automated workflow, for instance — we conclude a data processing agreement under Article 28 of the General Data Protection Regulation. We provide the draft, and your legal advisers can review it.
It sets out subject matter, duration, type of data, technical and organisational measures and the handling of sub-processors. If a project manages without personal data, we record that in writing too.