www.privasee.io Open in urlscan Pro
34.251.201.224  Public Scan

Form analysis
0 forms found in the DOM

Text Content

PRIVASEE
Free GDPR AuditHow It WorksFeaturesPricingBlog
Sign Up / Log In



Blog



WHAT IS A DATA PROCESSING AGREEMENT VS A PRIVACY POLICY?

By
Alex Franch
March 8, 2023



TABLE OF CONTENTS


Terms and Conditions vs Data Processing Agreement
Terms and Conditions
Data Processing Agreement
Privacy Policy vs Data Processing Agreement
Hotjar - SaaS Example
Accountant - Service Provider Example
International Data Transfers
Standard Contractual Clauses
UK International Data Transfer Agreement/Addendum
What to do if you're a SaaS?
Data Processing Agreement Checklist
Data Processing Agreement Template
How can Privasee help?
Exceptions


WHAT IS A DATA PROCESSING AGREEMENT VS A PRIVACY POLICY?

People often confuse the difference between a Data Processing Agreement vs a
privacy policy. In this article, we will outline the main differences and well
as to how a Data Processing Agreement is different from the Terms and Conditions
or Terms of Service.

A Data Processing Agreement (DPA) which is sometimes also called a (Data
Processing Addendum or Data Processing Terms) is an agreement between a Data
Controller and a Data Processor. This agreement is generally different and
separate from a company’s or website’s Terms and Conditions or Terms of Service
and different from a Privacy Policy and Cookie Policy.


TERMS AND CONDITIONS VS DATA PROCESSING AGREEMENT


TERMS AND CONDITIONS

Terms and Conditions normally outline things like:

 * The rules you need to follow to access the service
 * What is the service that will be given
 * How much you will pay
 * The liability in case something goes wrong etc…


DATA PROCESSING AGREEMENT

A Data Processing Agreement is like the Terms of Service but outlines the rules
for two companies sharing personal data, it outlines things like:

 * What personal data will be shared
 * Will this data leave the UK or European Economic Area
 * Which security measures (also called technical and organisational measures)
   are in place to protect that data transfer
 * What sub-processors (third parties) will also process the data when the
   service is being offered?
 * Note: find more information on what a sub-processor is in this blog post:
   https://www.privasee.io/post/what-is-a-sub-processor
 * the liability in case something goes wrong
 * the responsibilities of the controller
 * the responsibilities of the processor
 * Other important bits



Article 28 of the GDPR sets out the rules that processors must follow when
processing information on behalf of their controllers.


PRIVACY POLICY VS DATA PROCESSING AGREEMENT

A Privacy Policy outlines mainly how you process personal data when you’re a
Controller while a Data Processing Agreement in most cases (especially if you’re
a SaaS) outlines how data is processed when a Processor offers a service or when
there’s a transfer of personal data from one company to another.


HOTJAR - SAAS EXAMPLE

Hotjar - a popular analytics tool is a snippet of code that you can add to the
Website of Company A to capture recordings of how a user uses that website with
the objective of optimising it. In this scenario, Hotjar is a processor as it
collects website usage data on behalf of Company A (the Controller).

The GDPR says that before Hotjar can start processing the information on behalf
of Company A there must be written instructions on what can be done with that
data - this agreement is called the Data Processing Agreement.

Moreover, Hotjar is a big company that also acts as a Controller in other
situations for example when it has its own website visitors and processes
information of its customers, employees and other people therefore its
responsibility under the GDPR to also have a Privacy Policy disclosing how they
process all this information.


ACCOUNTANT - SERVICE PROVIDER EXAMPLE

Accountants LTD do payroll for Company A. Given that it's Company A that is
instructing Accountants LTD to run its payroll, the Accountants are acting as a
Processor for Company A which is the Controller. In this situation, a Data
Processing Agreement needs to be put in place prior to the data being
transferred.


INTERNATIONAL DATA TRANSFERS

When creating a Data Processing Agreement, we need to check if for that service
to be carried out information will be sent outside of the European Economic Area
(EEA), the United Kingdom (UK) or a country that has an adequacy status (AC).

Note that the transfer may occur from the Controller (Company A) to the
Processor (Hotjar) or the other way around.

In the case where one of the two companies is located outside of the EEA, UK or
AC, then we have to check if we need to apply Standard Contractual Clauses
(SCCs) or the UK International Data Transfer Agreement/Addendum (UK IDTA).


STANDARD CONTRACTUAL CLAUSES

The Standard Contractual Clauses (SCCs) are a set of clauses that need to be
added to a Data Processing Agreement when information is being transferred
outside of the European Economic Area. These clauses aim to give the data a
similar level of security when they are outside of the European Union as when
they are inside the European Union subject to the EU GDPR. For International
Transfers there are four modules which need to be chosen depending on the
relationship between the parties sending the data. You can learn more about this
in our blog post here (coming soon).


UK INTERNATIONAL DATA TRANSFER AGREEMENT/ADDENDUM

The UK International Data Transfer Agreement/Addendum also needs to be appended
to your Data Processing Agreement if you are processing data from the UK outside
of the UK, EEA or AC. There are two versions of these clauses one of which is an
Agreement which needs to be added when data from the UK is transferred outside
of the UK, EEA or AC but there are no Standard Contractual Clauses already
appended and the Addendum which can be bolted on to the SCCs.


WHAT TO DO IF YOU'RE A SAAS?

If you are a SaaS that is processing personal data as part of the service that
you offer your clients. It's very likely that you will be processing the
information as a Data Processor and will require a Data Processing Agreement.


DATA PROCESSING AGREEMENT CHECKLIST

 * We have established the roles in the DPA (is the sender a controller or
   processor, is the recipient a controller or processor).
 * We have linked it to our terms of service agreement.
 * We have defined the terms or duration of the processing of personal data.
 * We have decided on our breach notification period.
 * We have decided on our Sub-processor Notification Period.
 * We have decided whether to include a liability cap or not and if so, added
   the cap amount.
 * We have explained the governing law and jurisdiction of the Data Processing
   Agreement.
 * We have explained the Data Protection Regulations which apply (UK GDPR, EU
   GDPR, CCPA, CPRA...).
 * We have described the services that are related to the processing of personal
   data.
 * We have explained the nature and purpose of processing.
 * We have explained what personal data is going to be transferred.
 * We have explained who are the individuals whose Personal Data is being
   transferred.
 * We have indicated which transfer mechanisms we will be used if the data is
   being transferred outside of the EEA, UK or AC.
 * We have explained the Security Measures (Technical and organisational
   measures) that will protect personal data.
 * We have explained the sub-processors that we will use alongside the purpose
   for using them, the country where the data will reside and the sub-processor
   security measures (or technical and organisational measures).
 * You have set out the controller obligations
 * You have set out the processor obligations

You can find a Notion Template (downloadable and exportable to PDF) of the
checklist here.


DATA PROCESSING AGREEMENT TEMPLATE

You can find a Data Processing Agreement template here.


HOW CAN PRIVASEE HELP?

Privasee has a Data Processing Agreement and Security Measures module that can
help you generate all the Data Processing Agreements that you may need and
ensure they include the:

 * Necessary clauses of a Data Processing Agreement
 * Evaluate if you need Standard Contractual Clauses
 * Evaluate if you need the UK International Data Transfer Agreement or Addendum
 * Keep a list of sub-processors
 * Help you identify the terms that are most friendly to you
 * Keep your Data Processing Agreement up to date if anything changes in the
   legislation (for example complying with deadlines of the recent update to
   SCCs or the introduction of the requirement to add UK IDTAs)
 * Keep your Data Processing Agreement up to date if anything changes in your
   company (you add new features, change the data you use to provide your
   service or add or remove tools and third parties used in your company)


EXCEPTIONS

Note: for simplicity in this article we have not explained the exceptions that
apply for professions like Doctors, Lawyers, Accountants (when doing
bookkeeping), Financial Advisors and other regulated professions that are likely
to act as Independent Controllers and not Processors. We're more than happy to
explain the differences via Live Chat though!

Note 2: in this blog post we have considered the most typical use-case for a
Data Processing agreement between a Controller and a Processor, but a Data
Processing Agreement may be required between a Controller and Processor, from
Processor to Processor, from Processor back to the Controller or from an
Independent Controller to another Independent Controller.

‍

Share this post
This is some text inside of a div block.

This is some text inside of a div block.

This is some text inside of a div block.

This is some text inside of a div block.
Alex Franch
Co-Founder & CEO
March 1, 2023

Alex Franch is the co-founder and CEO of Privasee. With a background in computer
science and cybersecurity, it is no surprise that he is a highly analytical
problem solver; now putting these skills to use within the data privacy space.
Alex is passionate about GDPR, and productivity and spends a lot of time doing
sports as he values the importance of having a work-life balance. He is excited
to help businesses generate documentation, and become and maintain GDPR
compliance through the Privasee platform.

Get Compliant in <1 Hour


ARE YOU FULLY GDPR COMPLIANT?

Ensure your policies are always up to date with Privasee, an AI powered
GDPR compliance solution that does it all.

Get Started
How It Works
About
HomeHow It WorksFeaturesPricingBlogGDPR DictionaryGDPR Compliance
SoftwareGDPR Compliance ServicesSearch
Connect
Whatsapp
Email
Twitter
LinkedIn
Youtube
Contact
Legal
Terms & ConditionsPrivacy PolicyCookie Policy
Popular Articles
What is a Data Processing Agreement vs a Privacy Policy?
Who is a Data Subject? - GDPR Terms You Should Know
GDPR Cheat Sheet (What You Need To Know)
Latest Articles
Who is a Data Subject? - GDPR Terms You Should Know
Do I Need A Cookie Policy On My Website?
What is a Data Map? (& GDPR Terms You Should Know)
Stay up to date on the latest Privasee features and releases.



© 2022. All right reserved.
Privasee Group LTD, Room 1.01, Bush House North Wing Strand Campus, 30 Aldwych,
London, United Kingdom