Placepoint

Data processing agreement

A data processing agreement is the written contract that must be in place when a business lets someone else process personal data on its behalf. Examples are a management company that keeps the tenant register for an owner, or a system supplier that stores the data in the cloud. The agreement sets out what the supplier is allowed to do with the data, and it is a requirement under GDPR Article 28. The parties cannot opt out of it, and a service cannot be taken into use before it is signed.

The roles decide who needs the agreement. The controller decides the purpose of the processing, and the processor carries it out on assignment. Article 28(3) of the General Data Protection Regulation requires the agreement to set out the subject matter of the processing, the duration, the nature and the purpose, the type of personal data and the categories of data subjects. It must also require the processor to:

  • process the data only on documented instructions
  • keep it confidential
  • meet the security requirements in Article 32
  • assist the controller when data subjects ask for access or erasure
  • delete or return everything when the assignment ends
  • submit to audits

The agreement must be in writing, and electronic form is sufficient.

Sub-processors are the point where most agreements are thin. A processor cannot engage another processor without written permission. If the permission is given generally, the controller must be notified of new or replaced sub-processors and be able to object to the change. The processor is fully liable to the controller for the sub-processor meeting its obligations. A usable agreement therefore has an annex listing the sub-processors with name, service and country of operation. If one of them sits outside the EEA, the transfer needs its own basis under Chapter V of the Regulation. The European Commission's standard contractual clauses for controllers and processors can be used as a template, and Datatilsynet (the Norwegian Data Protection Authority) has its own guide to the content.

In property, the split of roles is usually clear once you look for it. The landlord is the controller for information about the tenants in a tenancy under husleieloven (the Norwegian Tenancy Act). The manager, the accountant and the system supplier are processors. In due diligence, the data room supplier is a processor for the seller. Exchanging tenant lists between seller and buyer in a property transaction, on the other hand, is a disclosure between two controllers. No data processing agreement helps there: each party must have its own legal basis for processing. A breach of Article 28 can lead to fines of up to 10 million euros or 2% of global annual turnover under Article 83(4). The liability for damages under Article 82 applies to both parties.

Placepoint is the controller for the property and company data we collect and pass on, including data from Grunnboken (the Norwegian land register) and matrikkelen (the Norwegian cadastre). You may send personal data into the service yourself, for example a national identity number in a lookup or a bulk extract you order. If you do, we process it on your assignment, and we enter into a data processing agreement under Article 28. Privacy and data processing describes what the agreement covers and how you get it.

From Placepoint's dictionary: Data processing agreement

More information: Datatilsynet: Databehandleravtale, Lovdata: General Data Protection Regulation Article 28, European Data Protection Board: Guidelines 07/2020 on the concepts of controller and processor

English: Data processing agreement (DPA), the controller-to-processor contract required by GDPR Article 28.

Common questions we come across

When do I need a data processing agreement?

When an external party processes personal data on your assignment: a manager, an accountant, a data room supplier, IT operations or a cloud service. The agreement must be in place before the processing starts. Both parties may be controllers, as with seller and buyer in a property transaction. In that case it is a disclosure and not a processing assignment, and each party needs its own legal basis under GDPR.

What must the agreement contain?

Purpose, duration, type of data and categories of data subjects. It must also set out the processor's obligations: being bound by instructions, confidentiality, security measures, assistance with access and erasure, deletion or return on termination, and access to audits. An annex should list the sub-processors with service and country of operation, since transfers out of the EEA require their own legal basis.

Who is responsible if the processor makes a mistake?

The controller answers for the choice of supplier and for the instructions. The processor can be fined directly for its own obligations and is fully liable for the sub-processors it uses. Towards the data subject, both can be held liable for damages.

Do I need a data processing agreement with Placepoint?

Placepoint is the controller for the property and company data we pass on, such as information from Grunnboken about the registered owner. That data is therefore not a processing assignment. If you send personal data into a lookup or an extract, we process it on your assignment, and we enter into a data processing agreement for that.