Mandatory, often forgotten, and only relevant when something goes wrong.
A processing agreement is a written agreement with every party that processes personal data on your behalf: your hosting party, your email platform, your CRM. It states what they are allowed to do, how they protect it, how long they store it and what happens in the event of a data breach. This is mandatory under the GDPR.
IN COMMON LANGUAGE
Who you need one with
With anyone who touches your customers' data on your behalf. Hosting, form services, email platforms, accounting software, CRM and your website builder if they have access.
Not with parties who are responsible for their own processing, such as your accountant. That distinction is legal and worth having it tested.
WHY IT MATTERS
What belongs in it
What data, for what purpose, for how long, how secured, who else can access it, and what happens in the event of a leak or termination.
Most serious suppliers have a standard version ready. Ask for it: it's usually a matter of downloading and signing.
- With every processor — hosting, email, CRM, forms.
- Request standard version — most suppliers have one.
- Be aware of subcontractors — who engages your supplier.
- Agreement about data leaks — how quickly do they report to you.
- What happens when you stop — data is deleted or returned.
FREQUENTLY ASKED QUESTIONS
More about a processing agreement
Do you have one?
Yes. When we process data on your behalf: for example with hosting or form processing: we conclude a processing agreement. This is standard part of the assignment and not as a separate item.
What if a supplier doesn't want to sign one?
That's a warning. A professional party has arranged this. Refusing means that you bear the risk without agreements, and that is a reason to choose another supplier.
Should I have this done by a lawyer?
The standard versions from established suppliers are usually fine. If you deviate or if it concerns sensitive data, have it tested: we are not lawyers.
CONTINUE READING
Of course, continue reading about this subject.
Processors mapped out?
We help you identify which parties process data from your customers.