Processing of personal data

Typical wording

The supplier processes personal data on the customer's behalf under a separate data processing agreement, which forms an annex to this agreement.

What it means

The supplier processes information about people for you, and the rules for that sit in a separate agreement that applies alongside the main one.

Common practice

Where a supplier processes personal data for the customer, a data processing agreement is required under Article 28 of the General Data Protection Regulation. It is common for it to sit as an annex, and for sub-processors to be listed and notified on change.

What to look for

• Is the data processing agreement actually attached, or only mentioned?
• Where is the data processed, and is it transferred outside the EEA?
• Are sub-processors listed, and are you notified on change?
• What happens to the data on termination - deletion or return?

Source