Data processing agreements and transfers of personal data to third countries
Drafting and negotiating the contracts under which personal data are shared with vendors, partners and entities in other countries.
Scope of services
- Data processing agreements under Article 28 GDPR – for controllers and processors.
- Assessment of whether a counterparty is a processor, a separate controller or a joint controller.
- Joint controller arrangements (Article 26 GDPR).
- Transfers to third countries: adequacy decisions, standard contractual clauses, transfer impact assessments.
- Review of sub-processors.
- Liability, audit and breach notification clauses.
Cloud and IT providers
Contracts with cloud, software and IT service providers are often based on the provider's standard terms. We check whether they meet Article 28 GDPR, where the data are physically processed and who has access to them.
Frequently asked questions
Does a processing agreement have to be a separate document?
No. The required provisions may be included in the main contract or in an annex. What matters is that the contract contains the elements listed in Article 28(3) GDPR, including the subject matter, duration, nature and purpose of processing and the processor's obligations.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.