Data processing agreement (GDPR art. 28)
You are the controller, we are the processor. This agreement sets out what that means.
Last updated: July 2026
This document is not published yet
We do not publish binding text without legal review. A credible but unreviewed document would be relied on as if it were intended, which is worse than its absence.
What it will cover:
- Subject matter, duration, nature and purpose of the processing
- Categories of data and of data subjects
- Our obligations: instructions, confidentiality, security, assistance
- Use of sub-processors and advance notice
- What happens to data at the end of the contract, and the right to audit
If you need it for a procurement file or a tender, write to us: we will send the working version and the timeline.