{"id":42910,"date":"2021-03-01T15:59:25","date_gmt":"2021-03-01T07:59:25","guid":{"rendered":"https:\/\/zegal.com\/?p=42910"},"modified":"2023-02-06T16:28:06","modified_gmt":"2023-02-06T08:28:06","slug":"why-does-my-company-need-a-data-processing-addendum-dpa","status":"publish","type":"post","link":"https:\/\/zegal.com\/en-gb\/blog\/post\/why-does-my-company-need-a-data-processing-addendum-dpa\/","title":{"rendered":"Why does my company need a Data Processing Addendum (DPA)?"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

To begin, a Data Processing Addendum (DPA)<\/b> is a contract between data controllers and data processors. The main purpose of a Data Processing Addendum (DPA) is to protect the user\u2019s data in compliance with the GDPR or any other Privacy Laws.<\/p>\n\n\n\n

For example, you have a business that operates through a website and collects the information of the visitors visiting your website. But, at some point, your business has to work with some other third-party processor to handle some of the data. Therefore, at that time a \u201cData Processing Addendum\u201d will help your business legally if said third-party misuses your user\u2019s data. <\/p>\n\n\n\n

Importantly, one of the key changes introduced by the GDPR is that a clear framework of responsibility is established for data protection. Essentially, a data controller may only appoint processors that provide a \u201csufficient guarantee\u201d to meet the requirements of the GDPR. A data processor may only act on \u201cdocumented instructions\u201d of the controller. And, must comply with a number of requirements to ensure that the controller will fulfil its obligations under the GDPR. <\/p>\n\n\n\n

<\/span>Do I need a Data Processing Addendum (DPA)?<\/b><\/span><\/h2>\n\n\n\n

If you\u2019re running a business that works with user\u2019s data, then you need a Data Processing Addendum. Having a Data Processing Addendum <\/strong>will help your business in a legal dispute if a third-party try to misuse your user\u2019s data. It offers protection for your company for any third party act that is not in compliance with GDPR or other privacy laws.<\/p>\n\n\n\n

Essentially, without a DPA your business might be at risk if a third-party provider tries to manipulate your user\u2019s data. This is the case because the wrong-doings of that third-party would otherwise fall on your company\u2019s head. Additionally, there are not only legal ramifications but also the damage to the reputation of your company that may result in a decrease in revenue. <\/p>\n\n\n\n

<\/span>What is GDPR & PDPA?<\/b><\/span><\/h2>\n\n\n\n

In a nutshell, every country has their own set of data protection and privacy laws. For instance, the European Union has established the General Data Protection Regulation<\/b> (GDPR) act.  In Singapore, they have PDPA<\/b>, which stands for Personal Data Protection Act 2010. This regulates the processing of all personal data that has been collected while making any commercial transaction.<\/p>\n\n\n\n

The General Data Protection Regulation (\u201cGDPR<\/b>\u201d) is a new privacy law in the European Union (\u201cEU\u201d) that came into force on 25 May 2018. The GDPR regulates the protection of personal data, which includes any information that can be used to identify a person, such as a name, identification number, location data, or online identifier, and a wide range of other types of information. The GDPR applies to all businesses in the EU, including the UK.<\/p>\n\n\n\n

However, if you are a business outside the EU that collects personal data from individuals in the EU, and you make decisions about how and why personal data is used, you will be considered a \u201ccontroller\u201d under the GDPR. And, will be subject to its rules regarding the data of those individuals. If you process the personal data of individuals in the EU on behalf of a controller, you will be considered a \u201cprocessor\u201d and will also need to comply with the GDPR.<\/p>\n\n\n\n

<\/span>Conclusion on DPA<\/b><\/span><\/h2>\n\n\n\n

The Data Processing Addendum<\/b> supplements any service agreement<\/a> (or terms of service) already in place. Importantly, the Data Processing Addendum is not just a document that is nice to have. It is mandatory The GDPR, for instance, requires that processing of personal data by a service provider on behalf of a data controller must be governed by a binding contract. It sets out details of the personal data by the processor on behalf of the controller and each party\u2019s responsibilities in such processing.<\/p>\n\n\n\n

You Might Also Like<\/strong><\/h4>\n\n\n\n

Along with this document, make sure you see these other templates in our library:<\/p>\n\n\n\n