What a controller or a processor needs to know…in a nutshell
- 29 August 2024
- Privacy and Data Protection
Data processing agreements (DPAs) are a common feature of contracts for the supply of services, for example often featuring as self-contained schedules to master services agreements (MSAs).
If the services include, even incidentally, processing of personal data – and processing can include a multitude of operations such as collection, recording, organisation, structuring, storage, alteration, retrieval, erasure or destruction, and even transfer to third parties – then there is a legal requirement for the controller (the customer who, as controller, is the person who determines the purposes and means of personal data processing) to have a DPA in place with the processor (the service-provider).
The UK GDPR (which is the UK version of the EU General Data Protection Regulation) requires processors’ activities to be governed by a contract (ie a DPA) and sets out (in Article 28) very specific obligations for processors, including:
Article 28 also provides that the DPA has to set out certain information, including the subject-matter, duration, nature and purpose of the processing, and the types of personal data processed and categories of data subjects. This information is often set out in an Annex to the DPA and, in the case of many services agreements, may well not change from the start of the contract.
One issue which often arises is limitation of liability for breach of a DPA (there is often indemnification of the controller by the processor for breach).
The answer is a very firm yes. Notwithstanding the fact that the DPA must contain prescribed clauses, factors such as the nature and sensitivity of the personal data involved and the nature of the services to be carried out by the service-provider mean that each DPA should be reviewed carefully and tailored as necessary to the particular circumstances of the contractual relationship which it underpins.
From a controller point of view, for example, it may be necessary to strengthen and add to the requirements set out in Article 28 given the above factors – for example, by including additional requirements for processor personnel, data security measures and audit rights.
For a processor, unless there is good reason for it, then the processor obligations in the DPA should be as closely aligned to those set out in Article 28 as possible and should not go materially beyond them.
One issue which often arises is limitation of liability for breach of a DPA (there is often indemnification of the controller by the processor for breach). Typically, the services agreement (eg MSA) in which the DPA is contained will have limitations on the liability of the service-provider in relation to breach. The financial consequences of breach of a DPA by a processor are potentially very significant for a controller – eg the cost of restoring lost data and large fines – so there will often be discussion in negotiations about a “super-limit” for DPA breaches. Whilst the customer will base their approach on the size of potential fines, the processor will be putting forward a risk-based argument based on the nature of the services and of the personal data involved to reduce that “super-limit” to something commercially realistic given the value of the contract (and the possibility of insuring all or part of the risk).
Without a fit for purpose DPA in place in relation to which each party is fully aware of and compliant with its obligations, there is a material risk of enforcement action by the UK Information Commissioner’s Office and potential criminal liability for either or both of the controller and processor. So it’s definitely worth spending some time and effort on getting it right.
Keep up to date with the latest tips, analysis and upcoming events by our legal experts, direct to your inbox.
Disclaimer
This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.