Module 2 · Chapter 4

Negotiating a Data Processing Agreement (Article 28)

The law says what a data processing agreement must cover. This chapter shows how a supplier and a large customer agree the rest: audits, breach news, new suppliers and money.

≈ 10 min read 8-question test

In this chapter

  • What the law makes every data processing agreement say
  • How a customer’s own draft was marked up, ask by ask
  • Why the supplier keeps a limit on what it can owe

4.1A data processing agreement in one paragraph

Corrandale decides about its care workers’ data, and Tennerby holds it in the app. The law lets Tennerby do that only under a written contract, the Data Processing Agreement. The law lists what that contract must cover. It leaves the numbers, such as how fast or how often, to the two sides.

Corrandale’s solicitors sent their own draft, and you marked it up for Tennerby. A mark-up is the draft with your changes shown. Most of the signed terms came from Tennerby’s form.

Key point

The law says what the Agreement must cover, but not how fast, how often or how much. Those numbers are what the two sides negotiate.

Also in this chapter

  1. What the law makes every agreement say
  2. Corrandale’s draft against Tennerby’s form
  3. Corrandale’s own promise about the data
  4. Permission for new suppliers, and speed after a breach
  5. A limit on what each side can owe
  6. Your job

Preview

The rest of this chapter opens with a free account. Every edition is free to read until 31 January. Open a free account by the end of that day and keep every edition published by then, for good. Open it from the edition home →