Legal & policy
Data Processing Agreement Outline
Use this as a procurement outline, not as a signed legal agreement.
Roles
The final agreement should define when Union Call Forms acts as processor/service provider and when the customer acts as controller/business.
Instructions
Processing should be limited to documented customer instructions and the configured service.
Confidentiality and security
The final agreement should describe staff confidentiality, access controls, incident handling and the security measures actually used in production.
Sub-processors
The final agreement should list approved sub-processors and a process for notifying customers of material changes.
Deletion and return
The final agreement should state how customer data is returned or deleted at termination and any lawful exceptions.
Cross-border processing
The final agreement should identify data locations and any transfer mechanism that applies to the actual production architecture.