When do you need a data processing agreement?

If you bring in someone who will be processing personal data for you, such as a new supplier, a data processing agreement must be in place. This agreement establishes that the new person may not use the personal data for his or her own purposes and that this person must immediately report any data leaks.

The university has already established a data processing agreement for standard applications that process personal data. If you are bringing in a new person, or if you’re not sure if someone has already signed a data processing agreement, contact your privacy officer.

What should be included in a data processing agreement?

You can use the university’s standard data processing agreement, which you can request from your privacy officer. You should include the following items in this agreement:

• The topic and the duration of the data processing.
• The nature and the objective of the data processing.
• The type of personal data.
• The categories of those involved.
• The rights and obligations of the person responsible for processing the data.

Do you want your data processing agreement to be reviewed? Please contact the Privacy Service Point.