Roles and instructions
Where the partner is the data controller and the platform its processor, personal data shall be processed only under documented instructions, including agreed services, categories of data, purposes and duration.
Confidentiality and security
Personnel access must be restricted on a need-to-know basis. Production requirements include role separation, encryption in transit, access logging, environment segregation, credentials management, backup recovery and security incident processes proportionate to the services.
Subprocessors
Cloud hosting, suppliers, payment services and AI support may involve additional processors. The final DPA must identify the approved list, onboarding notification process, contractual safeguards and cross-border transfer mechanisms where necessary.
Assistance and incidents
The processor should assist the controller with data subject rights, security incidents, impact assessments and regulator enquiries as required by the applicable agreement and law. Confirm notification timelines and escalation routes contractually.
Return, deletion and audit
At termination, the parties must agree on return and deletion of data except where retention is legally required. Evidence of compliance and appropriate audit arrangements must be described in the executed DPA.
Schedules to complete
Annexes should describe categories of data and individuals, technical and organisational safeguards, subprocessors, service regions, authorised transfers and permitted retention periods.