What A Controller Or A Processor Needs To Know…in A Nutshell

Data processing agreements (DPAs) are a common feature of contracts for the supply of services, for example often featuring as self-contained schedules to master services agreements (MSAs).

Why are they there?

If the services include, even incidentally, processing of personal data – and processing can include a multitude of operations such as collection, recording, organisation, structuring, storage, alteration, retrieval, erasure or destruction, and even transfer to third parties – then there is a legal requirement for the controller (the customer who, as controller, is the person who determines the purposes and means of personal data processing) to have a DPA in place with the processor (the service-provider).