Jump to Section
Need help with a Data Processing Agreement?
Post Your Project (It's Free)
Get Bids to Compare
Hire Your Lawyer
Data processing agreements are critical to running a legally compliant business in a digitally encrypted world. Passed in the European Union in 2016, the General Data Protection Regulation (GDPR) set a new tone when it comes to protecting consumer data and privacy throughout the world. These laws continue to span reach throughout the world as other countries and states enact separate laws and requirements.
You need data processing agreements for consumers if you:
- Have a website
- Collect customer data
- Make sales online
As you can see, these rules affect a large majority of the world. Learn everything you need to know about data processing agreements by continuing the article below.
What is a Data Processing Agreement?
A data processing agreement, also called a DPA, is a legal contract between a data controller and a data processor. They regulate the use of consumer data by companies, specifically how it is processed. In essense, the data processor promises to utilize personally identifiable data (PII) according to the terms laid out in the data processing agreement.
If your website collects data from people living in locations with these rules, then your website processing agreements and data processing methods must be compliant with them.
Common types of company websites that should have data processing agreements include:
- Online retailers
- Internet marketers
- Online service providers
- Professional services firms
- B2B companies
- Financial institutions
- Technology firms
- Medical providers
If you run a large company, you will need to hire a data protection officer (DPO) to oversee and enforce your data privacy policies and data processing agreements. The internet is rife with the opportunity to expose your customer’s data, which can land your company in legal trouble with local authorities.
Avoid making this mistake by writing a personalized data processing agreement for your company while having the appropriate safeguards in place to monitor compliance.
Here is an article about data protection officers (DPO).
Key Terms in a Data Processing Agreement
Data processing agreements, like all contracts, contain key terms and provisions that help both parties understand their rights and responsibilities. In the case of a data processing agreement, the consumer, or the data control, must agree to the company’s or data processor’s terms to use their website or application.
The key terms in a data processing agreement include:
- Subject matter
- Data used
- Data categorizations
- Rights and obligations
- Rights if a data breach occurs
These rights and obligations may vary according to state, industry, country, and company type. When there are numerous variables involved with a contract, it is essential that you consult with privacy lawyers to help ensure that they are objective-oriented, compliant, and enforceable. Otherwise, you could leave yourself exposed to fiduciary liabilities in the future.
Why You Need A Data Processing Agreement
Your company needs a data processing agreement to remain compliant with a jurisdiction’s relevant laws. If you do not have these agreements in place and utilize consumer data, you could face significant penalties. While legislation is forthcoming slowly, a few noticeable places are enacting strict measurements.
DPAs and the GDPR
The General Data Protection Regulation (GDPR) summaries how companies must process, store, and use customer data. These regulations are contained within Article 28 of the GDPR text enacted by the European Union (EU).
Counties in the EU include:
- Republic of Cyprus
- Czech Republic
Regardless of where your target audience resides in the EU, DPAs are an essential website component across many business types and industries. Data controllers also have specific legal protections.
Ensure that your data processing agreement addresses the following rights:
- Right to opt-out
- Right to be informed
- Right to disclosure
- Right to deletion
- Right to equal services and prices
Lawmakers have authorized the Data Protect Authorities to impose fines of up to €20 million or 4 percent of global turnover annually, whichever of the two is greater, for GDPR violations. Work with a team of legal and technological professionals to help you create an agreement and process that helps you accomplish your company objectives while remaining compliant within the EU.
DPAs and the CCPA
On the other hand, the California Consumer Privacy Act (CCPA) is the state’s ePrivacy directive that outlines how companies can use consumer data, including tracking browsers and data encryption requirements. These rules apply to first and third-party services providers and retailers.
Data Processing Agreements and Small Businesses
Small business owners stretch their budgets and may wonder if having data processing agreements are really necessary. They are generally not exempt from meeting data processing agreement requirements. However, some geographical regions may have more lax regulations in your area.
Other Reasons to Not Use Data Processing Agreements
You also do not need to have a data processing agreement if your target market is not located in a place with such requirements. Always speak with internet lawyers in your state to determine if your small business needs to utilize data processing agreements.
Why You Should Get Started Early
We will likely see continued legislation crop up throughout the United States and the world. It may not be a bad idea to get a jump on the practice now while observing good data processing ethics. Your early adopter and tech-savvy customers are sure to take note of your above-and-beyond efforts.
Image via Pexels by Soumil Kumar
Writing A Data Processing Agreement
It’s essential that you write a data processing agreement that serves its intended purposes. However, the terms and conditions you write must also remain compliant with local, state, federal, country, and industry requirements depending upon your business. Use a methodical approach to ensure that you obtain the desired result.
Follow these steps when writing a data processing agreement:
- Step 1. Determine what customer data is essential
- Step 2. Decide upon how long you need to store/process the data
- Step 3. Write down how you plan to use the data in your own words
- Step 4. Finalize this information with key company stakeholders
- Step 5. Schedule an initial intake with a privacy lawyer
- Step 6. Work with the lawyer you hired to finalize the policy
Get Help with a DPA
Online agreements, like Data Processing Agreements, are best left to experts that understand the way browsers, software, and online marketing works, as well as being familiar with global data privacy laws. Post a project on ContractsCounsel’s marketplace to get bids from vetted technology lawyers that can help.
Meet some of our Data Processing Agreement Lawyers
William L Foster has been practicing law since 2006 as an attorney associate for a large litigation firm in Denver, Colorado. His experience includes drafting business contracts, organizational filings, and settlement agreements.
Terry Brennan is an experienced corporate, intellectual property and emerging company transactions attorney who has been a partner at two national Wall Street law firms and a trusted corporate counsel. He focuses on providing practical, cost-efficient and creative legal advice to entrepreneurs, established enterprises and investors for business, corporate finance, intellectual property and technology transactions. As a partner at prominent law firms, Terry's work centered around financing, mergers and acquisitions, joint ventures, securities transactions, outsourcing and structuring of business entities to protect, license, finance and commercialize technology, manufacturing, digital media, intellectual property, entertainment and financial assets. As the General Counsel of IBAX Healthcare Systems, Terry was responsible for all legal and related business matters including health information systems licensing agreements, merger and acquisitions, product development and regulatory issues, contract administration, and litigation. Terry is a graduate of the Georgetown University Law Center, where he was an Editor of the law review. He is active in a number of economic development, entrepreneurial accelerators, veterans and civic organizations in Florida and New York.
I'm a Washington-licensed lawyer specializing in trademark practice and with an extensive trademark education and academic background. I currently work with domestic and international businesses seeking trademark protection in the U.S. by conducting trademark searches, providing legal advice, submitting USPTO applications, and preparing responses to office actions. I'm passionate about trademark law and always looking forward to helping small and medium businesses promote their value by having a registered federal trademark. If you have questions or concerns about trademark/copyright/IP licensing and require legal advice, feel free to contact me so we can have a first chat.
Mr. Pomeranz serves as the principal of Pomeranz Law PLLC, a boutique law firm representing clients across myriad industries and verticals. Before founding the firm, Mr. Pomeranz served as Senior Vice President, Legal & Compliance and General Counsel of Mortgage Connect, LP in 2017. Mr. Pomeranz also served as Counsel, Transactions for Altisource Portfolio Solutions S.A. (NASDAQ: ASPS) beginning in 2013, and was based in the company’s C-Suite in Luxembourg City, Luxembourg. Mr. Pomeranz began his career with Mainline Information Systems, Inc. as an in-house attorney.
I have 10 years experience providing general counsel, in the form practical and timely legal advice, under strict deadlines to individuals and various business unit stakeholders, balancing commercial needs with legal concerns at large corporations and start-ups. I am skilled at reviewing, analyzing, drafting and negotiating commercial and government contracts globally for the procurement and sale of services and goods. I also help clients ensure compliance with regulations (including data privacy), laws and contractual obligations and protect, enforce and exploit intellectual property rights and support in the development of IP strategy. I am a Certified Information Privacy Professional/United States (CIPP/US) licensed by the IAPP - International Association of Privacy Professionals.
Over 15 year experience drafting, reviewing and negotiating contracts both as in-house counsel and in law firms, including my own law firm.
Rinky S. Parwani began her career practicing law in Beverly Hills, California handling high profile complex litigation and entertainment law matters. Later, her practice turned transactional to Lake Tahoe, California with a focus on business startups, trademarks, real estate resort development and government law. After leaving California, she also served as in-house counsel for a major lending corporation headquartered in Des Moines, Iowa as well as a Senior Vice President of Compliance for a fortune 500 mortgage operation in Dallas, Texas prior to opening Parwani Law, P.A. in Tampa, Florida. She has represented various sophisticated individual, government and corporate clients and counseled in a variety of litigation and corporate matters throughout her career. Ms. Parwani also has prior experience with state and federal consumer lending laws for unsecured credit cards, revolving credit, secured loans, retail credit, sales finance and mortgage loans. She also has served as a special magistrate and legal counsel for numerous Florida County Value Adjustment Boards. Her practice varies significantly from unique federal and state litigation cases to transactional matters. Born and raised in Des Moines, Iowa, Ms. Parwani worked in private accounting for several years prior to law school. Her background includes a Certified Public Accountant (CPA) certificate from Iowa (currently the license is inactive) and a Certified Management Accountant (CMA) designation (currently the designation is inactive). Ms. Parwani or the firm is currently a member of the following organizations: Hillsborough County Bar Association, American Bar Association, Tampa Bay Bankruptcy Bar Association, National Association of Consumer Bankruptcy Attorneys, and the American Immigration Lawyers Association. She is a Fellow of the American Bar Association. Ms. Parwani is a frequent volunteer for Fox Channel 13 Tampa Bay Ask-A-Lawyer. She has published an article entitled "Advising Your Client in Foreclosure" in the Stetson Law Review, Volume 41, No. 3, Spring 2012 Foreclosure Symposium Edition. She is a frequent continuing legal education speaker and has also taught bankruptcy seminars for the American Bar Association and Amstar Litigation. She was commissioned by the Governor of Kentucky as a Kentucky Colonel. In addition, she teaches Immigration Law, Bankruptcy Law and Legal Research and Writing as an adjunct faculty instructor at the Hillsborough Community College Ybor campus in the paralegal studies program.