Draft outline. This lists what the data processing agreement must cover; the final text has to be written with a lawyer before MCO launches.
Data processing agreement
Required by GDPR Article 28 for the personal data a company puts into MCO (its users, projects and files).
1. Roles
- The customer company is the controller for its users’ data and files; MCO is the processor.
2. Processing details
- Subject matter, duration, nature and purpose, types of data and data subjects.
3. Obligations
- Only on documented instructions, confidentiality, security measures (encryption, access control, two-step verification, audit log).
- Sub-processors list (Microsoft, Stripe, email provider) and how customers are told about changes.
- Help with data subject requests, breach notification within 72 hours, deletion or return of data at the end.