Customer data processing arrangements

Customers can request a DPA for their organization. Our data processing arrangements address the services and instructions concerned, the parties’ roles, data categories, individual rights, security, providers, transfers, and return / deletion.

This page summarizes the contractual subjects. A customer-specific executed agreement governs the obligations for its scope. Reading this page or sending an enquiry does not sign a DPA, execute standard contractual clauses, or purchase a residency arrangement.

1. Roles, scope, and documented instructions

Customer processing terms identify the controller / Data Fiduciary and processor roles for the data processed under documented instructions. They describe the subject matter, duration, nature, purposes, data categories, and individuals involved. Independent-controller activities, including independently maintained research datasets, are addressed according to their actual role. Instructions and transfer arrangements follow applicable law.

2. Confidentiality, security, and subprocessors

Data processing arrangements address authorized personnel and confidentiality, appropriate technical and organizational measures, and the applicable authorization process for subprocessors. They cover equivalent data protection duties, change notifications, objections where applicable, and responsibility for subprocessor performance.

3. Rights requests, incidents, and assessments

The relevant processing terms address assistance with individual rights, security obligations, incident assessment / notification, impact assessments, and regulatory consultation. Where acting as processor, breach notification to the controller is required without undue delay after awareness, with information supplied as it becomes available. Contractual procedures do not replace applicable statutory deadlines.

4. Return, deletion, audit, and evidence

Customer arrangements cover return or deletion of processor data at the end of service, including copies and backup treatment, subject to lawful retention. Information and audit arrangements support demonstration of compliance while protecting confidentiality and service security.

5. International transfers and California terms

Where required, the parties must agree an appropriate transfer instrument, correct modules, completed annexes, transfer assessment, and supplementary measures. No transfer tool is executed by this page. Where California service-provider / contractor rules apply, the agreement must include the required limited-purpose use, sale / sharing restrictions, combination restrictions and exceptions, equivalent protection, notice of inability to comply, and rights to monitor, stop, and remediate unauthorized processing.

6. Customer-specific schedules

• Parties, contacts, roles, service description, instructions, and duration.
• Individuals, personal-data categories, sensitive-data restrictions, and processing purposes.
• Security measures, incident contacts, rights assistance, and audit arrangements.
• Subprocessors, contracting entities, countries, onward transfers, and change processes.
• Retention, return / deletion, backups, transfer instruments, residency scope, and agreed commercial terms.