What a DPA is
When an organisation (the controller) has a service provider (the processor) handle personal data on its behalf – hosting, e-mail, a collaboration tool – Article 28 GDPR requires a contract or other legal act that binds the processor. This is the data processing agreement, in German Auftragsverarbeitungsvertrag (AVV).
The controller stays responsible for the processing. The DPA makes sure the processor only acts on documented instructions and offers sufficient guarantees for the protection of the data.
What it must contain
Article 28(3) GDPR lists the minimum content. Among other things:
- Subject matter, duration, nature and purpose of the processing, types of personal data and categories of data subjects.
- Processing only on documented instructions of the controller.
- Confidentiality of the people authorised to process the data.
- Technical and organisational security measures (Article 32).
- Rules for engaging subprocessors – only with prior authorisation.
- Support with data subject requests, security incidents and impact assessments.
- Deletion or return of the data when the service ends.
- Information and audits to demonstrate compliance.
DPA with Coviqo
Organisations that use Coviqo for their teams are the controller for their content; Coviqo processes it on their behalf. On the Business and Enterprise plans, admins can read, download and conclude the DPA directly in the organisation settings. The subprocessors are listed on Why a European collaboration platform.
This page is general information, not legal advice.
Frequently asked questions
Do I need a DPA for every tool?
You need one whenever a provider processes personal data on your behalf as a processor. That covers most cloud tools your organisation uses for work with personal data.
Is a DPA the same as the privacy policy?
No. The privacy policy informs the people whose data is processed. The DPA is a contract between controller and processor.