Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Master Services Agreement (“MSA”) between The Data Privacy Group Ltd (“Processor”) and the Customer (“Controller”). This DPA governs the processing of Personal Data where the Processor acts as a Data Processor on behalf of the Controller and is incorporated into any Statement of Work (“SoW”) by reference.

By signing the SoW, the Controller agrees to the terms of this DPA and the MSA. In the event of any conflict between the SoW, this DPA, or the MSA, the SoW shall prevail.

1. Definitions

  • Data Protection Laws: UK GDPR, the Data Protection Act 2018, the EU GDPR, and other applicable privacy laws.
  • Personal Data: Any information relating to an identified or identifiable natural person processed on behalf of the Controller.
  • Processing: Any operation performed on Personal Data (e.g., collection, storage, use, etc.).
  • Sub-Processor: Any third party engaged by the Processor to process Personal Data on its behalf.

2. Scope and Purpose

The Processor will process Personal Data solely on behalf of the Controller and in accordance with the Controller’s documented instructions, as required to provide the services agreed upon in the SoW.

3. Processor Obligations

  • The Processor will ensure that all staff authorised to process Personal Data are bound by confidentiality.
  • The Processor will implement appropriate technical and organisational measures to ensure the security of Personal Data.
  • The Processor will assist the Controller in fulfilling obligations relating to Data Subject rights, including responding to access, rectification, and erasure requests.

4. Data Processing Details

  • Subject Matter: The Processor will handle Personal Data in relation to the provision of the following services:
  • Product Licenses: Resale of licenses for OneTrust, Transcend, and any products developed by The Data Privacy Group.
  • Professional Services: Implementation of OneTrust or Transcend platforms.
  • Managed Services: Ongoing management of the Controller’s OneTrust or Transcend implementation.
  • Break-Fix Support: Addressing issues in previously implemented solutions.
  • Fractional DPO/CPO Services: Acting as a part-time Data Protection Officer or Chief Privacy Officer.
  • Consulting Services: Providing privacy solution design, best practice programme implementation, privacy advisory, and running training courses/workshops.
  • Ad-Hoc Hourly Based Contracts: Blocks of hours for services requested at the Controller’s discretion.
  • Duration: Processing will last for the duration specified in the SoW or until the agreement is terminated.
  • Categories of Data: May include, but is not limited to, name, contact information, login credentials, and email communication.
  • Data Subjects: Employees, clients, website users, or other individuals whose Personal Data is processed by the Controller in the course of using the Processor’s services.

5. Sub-Processors

The Processor will not engage Sub-Processors without the prior written consent of the Controller. Sub-Processors will be subject to the same data protection obligations as the Processor.

6. International Data Transfers

For the transfer of Personal Data outside the UK or EEA to countries that do not offer an adequate level of data protection, the Parties agree to adopt the following:

  • For UK Data Transfers: The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as applicable. UK IDTA Link
  • For EU Data Transfers: The European Commission’s Standard Contractual Clauses (SCCs) for processors. EU SCCs Link

These clauses will apply to any transfers of Personal Data to countries that do not offer an adequate level of data protection.

7. Data Breach Notifications

In the event of a Personal Data breach, the Processor will notify the Controller without undue delay and assist in complying with any legal obligations related to breach notifications.

8. Data Subject Rights

The Processor will assist the Controller in fulfilling its obligation to respond to Data Subject requests to exercise rights under applicable Data Protection Laws, such as access, rectification, erasure, and data portability.

9. Return or Deletion of Data

Upon termination of the agreement, the Processor will either return or securely delete all Personal Data unless retention is required by law.

10. Liability

Each Party is liable for its compliance with this DPA and applicable Data Protection Laws. The Processor’s liability for any breach of this DPA will be governed by the MSA and SoW.

Schedule 1: Standard Contractual Clauses (UK and EU SCCs)

For the transfer of Personal Data to third countries outside the UK or EEA, the following apply:

  • UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs for transfers from the UK. UK IDTA Link
  • EU Standard Contractual Clauses (SCCs) for transfers from the EEA. EU SCCs Link