A data processing agreement governs the relationship between the company that decides on the processing of data and the supplier that processes it on the company's behalf. It applies to a much wider range of partners than companies realise: providers of email tools, analytics, cloud services, accounting, HR systems, carriers and marketing agencies. The agreement must define the subject and purpose of the processing, the categories of data and data subjects, the duration of processing, the duty of confidentiality, security measures, the rules for engaging further sub-processors, cooperation in the exercise of data subjects' rights, and the procedure upon termination of the cooperation, including the return or deletion of data. Responsibility towards customers still rests with your company, so choosing a supplier is not a formality. Have the wording reviewed by a lawyer. Most large providers have an agreement prepared as part of their terms and conditions, but it needs to be consciously activated and its wording read through, not just clicked away.
See also: Privacy policy, Data transfers outside the EU, Contract with a marketing agency.
