Data Processing Agreement

A DPA is needed whenever you transfer personal data to a service provider that acts under your instructions for the specific purposes you have defined – what is called a processor. The same need appears if your company acts as a service provider for another company.  

Under the EU-GDPR, there are certain topics that need to be covered. These are defined in Art. 28 EU-GDPR and include the purpose, duration and nature of the processing, the need for the processor’s employee and staff to be under a duty of confidentiality and the processor’s obligation to only act under the instructions of the controller, assist the controller in complying with data subjects’ rights request, the security of the personal data and, in general, with the obligations enshrined in the EU-GDPR.  

Under Swiss law, however, the controller needs to ensure that the processor can guarantee the security and integrity of the personal data that is transferred to it. Furthermore, the agreement shall define that the processor can only use a sub-processor with the previous authorisation of the controller and that controllers need to be informed in case of data breaches. 

It can, but it needs to obtain the authorisation from the controller, as defined in the DPA. This can be done on a case-by-case basis, where the processor requests the authorisation from the controller every time they want to engage with a new sub-processor. It can also be done with a general authorisation included in the DPA, where the controller allows the processor to engage with new sub-processors for the future. 

In certain cases, personal data is not transferred to a processor (meaning a service provider that acts under the instructions of the controller), but to another company that, jointly with yours, also determines the purposes and means of the processing. In these cases and under the EU-GDPR, this relationship also needs to be governed by a contract, where the joint controllers determine their respective responsibilities and, in particular, how they will comply with data subjects’ rights and how they will provide the appropriate privacy notices to them.