Data Processing Agreement

1. Definitions

• “GDPR” means Regulation (EU) 2016/679, together with the Irish Data Protection Act 2018 and any other applicable national implementing or supplementing measures.
• “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” have the meanings given in Article 4 GDPR.
• “Client Personal Data” means Personal Data that the Processor processes on behalf of the Controller under the Engagement.
• “Engagement” means the signed proposal, statement of work, engagement letter, rules-of-engagement document or other written order between the parties.
• “Sub-processor” means any third party engaged by the Processor to process Client Personal Data.
• “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries adopted by European Commission Implementing Decision (EU) 2021/914.

2. Roles and scope

2.1 The Controller is the controller of Client Personal Data and the Processor is a processor acting on its behalf. Each party complies with the obligations that the GDPR places on it in that role.

2.2 The Controller warrants that it has a lawful basis for the processing, has provided all required information to Data Subjects, has obtained any necessary consents or authorisations, and that its instructions to the Processor do not cause either party to infringe applicable data-protection law.

2.3 Where the Processor determines the purposes and means of processing for its own account — for example in relation to its own client-relationship records, billing and business administration — it acts as an independent controller, and the Privacy Notice governs that processing instead of this DPA.

2.4 The parties do not intend to create a joint controller relationship under Article 26. If circumstances arise that would constitute joint control, the parties will enter into a separate arrangement that meets the requirements of Article 26.

3. Subject matter, duration and nature of processing

3.1 Subject matter. The provision of the Professional Services described in the Engagement.

3.2 Duration. The term of the Engagement, plus any period during which the Processor is required or permitted to retain Client Personal Data under clause 10.

3.3 Nature and purpose. Collection, organisation, structuring, storage, retrieval, consultation, analysis, disclosure to authorised recipients, restriction, erasure and destruction, in each case only as necessary to deliver the Services.

3.4 Types of Personal Data and categories of Data Subject. As specified in the Engagement. In the absence of specification, the following indicative scope applies.

3.5 Special categories. The Processor does not seek Article 9 or Article 10 data. The Controller must not provide it unless the Engagement expressly contemplates it and the parties have agreed the additional safeguards that will apply.

3.6 Data minimisation at source. The Controller will not supply live production data, credentials or special-category data where redacted, masked, synthetic or test data would be sufficient for the purpose.

4. Processor obligations

The Processor will:

4.1 Documented instructions (Article 28(3)(a)). Process Client Personal Data only on the Controller's documented instructions, including as to international transfers, unless required to do otherwise by Union or Member State law to which it is subject — in which case it will inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The Engagement, this DPA and the Controller's subsequent written instructions constitute the complete documented instructions.

4.2 Unlawful instruction (Article 28(3), final paragraph). Immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law, and may suspend the affected processing until the instruction is confirmed, amended or withdrawn.

4.3 Confidentiality (Article 28(3)(b)). Ensure that persons authorised to process Client Personal Data are bound by an enforceable obligation of confidentiality that survives the end of their engagement, are informed of the confidential nature of the data, and receive appropriate training.

4.4 Access limitation. Limit access to Client Personal Data to personnel who need it to deliver the Services, on a least-privilege basis, and revoke access promptly when it ceases to be needed.

4.5 Security (Articles 28(3)(c) and 32). Implement and maintain the technical and organisational measures described in clause 5.

4.6 Sub-processing (Articles 28(3)(d), 28(2) and 28(4)). Comply with clause 6.

4.7 Data subject rights (Article 28(3)(e)). Comply with clause 7.

4.8 Assistance (Article 28(3)(f)). Comply with clauses 8 and 9.

4.9 Deletion or return (Article 28(3)(g)). Comply with clause 10.

4.10 Information and audit (Article 28(3)(h)). Comply with clause 11.

4.11 Records (Article 30(2)). Maintain a written record of all categories of processing carried out on behalf of the Controller, and make it available to a Supervisory Authority on request.

5. Security of processing

5.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of natural persons, the Processor implements appropriate technical and organisational measures, including as appropriate:

• encryption of Client Personal Data in transit using current protocols, and at rest using full-disk or object-level encryption;
• pseudonymisation and redaction where the purpose can be achieved without direct identifiers;
• role-based access control, least-privilege provisioning and multi-factor authentication on all administrative access;
• logical segregation of each client's material, so that personnel assigned to one engagement cannot access another;
• logging of access to Client Personal Data, with logs protected against alteration;
• secure transfer mechanisms for client file exchange, in preference to email attachments;
• endpoint protection, patch management and configuration hardening on all devices used to process Client Personal Data;
• backup and tested restoration procedures supporting availability and resilience;
• secure destruction of physical and electronic media at end of life;
• background screening proportionate to role, confidentiality undertakings and periodic data-protection and security training for personnel;
• a documented and tested incident-response plan; and
• a process for regularly testing, assessing and evaluating the effectiveness of these measures.

5.2 The specific measures applicable to an Engagement, including any additional measures required by the Controller, are set out in the Engagement or in a technical and organisational measures schedule annexed to it. That schedule prevails over clause 5.1 to the extent of any inconsistency.

5.3 The Processor may update its measures over time provided that it does not materially reduce the overall level of security.

5.4 Where testing services are provided, evidence and artefacts generated during testing are handled in accordance with the data-handling provisions of the agreed rules-of-engagement document, which forms part of the Controller's documented instructions.

6. Sub-processors

6.1 General authorisation. The Controller grants the Processor general written authorisation to engage Sub-processors, subject to this clause 6.

6.2 Current Sub-processors. The Processor maintains a list of Sub-processors engaged for the relevant Services, specifying the name, the processing activity and the country of processing. The list is provided with the Engagement and is available on request at any time.

6.3 Changes and objection (Article 28(2)). The Processor will give the Controller at least thirty (30) days' prior written notice of the addition or replacement of a Sub-processor. The Controller may object on reasonable data-protection grounds within that period. The parties will then discuss the objection in good faith; if it cannot be resolved, the Controller may terminate the affected part of the Engagement on written notice without penalty, subject to payment for work completed and committed costs.

6.4 Flow-down (Article 28(4)). The Processor will impose on each Sub-processor, by written contract, data-protection obligations that are no less protective than those in this DPA, in particular as to security and confidentiality.

6.5 Liability. Where a Sub-processor fails to fulfil its data-protection obligations, the Processor remains fully liable to the Controller for the performance of that Sub-processor's obligations, subject to the limitations of liability in the Engagement and in section 25 of the Terms of Service.

6.6 Network Specialists. A legal, privacy or technical specialist engaged and paid by the Processor to deliver part of the Services is a Sub-processor for the purposes of this clause 6 wherever it processes Client Personal Data, and is subject to the notice, objection, flow-down and liability provisions above. Where a specialist exceptionally contracts directly with the Controller, it acts as a separate controller or processor under its own arrangements with the Controller and is not a Sub-processor of the Processor.

7. Data subject requests

7.1 Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests to exercise rights under Chapter III GDPR.

7.2 If the Processor receives a request directly from a Data Subject in relation to Client Personal Data, it will not respond to the substance of the request itself. It will acknowledge receipt where appropriate, direct the Data Subject to the Controller, and notify the Controller without undue delay and in any event within three (3) business days, providing the details needed for the Controller to respond within its own statutory deadline.

7.3 Assistance that is routine and proportionate is provided at no additional charge. Where assistance requires material effort beyond the scope of the Engagement, the Processor may charge at the rates stated in the Engagement, having first notified the Controller of the expected cost.

8. Personal data breaches

8.1 The Processor will notify the Controller without undue delay, and in any event within twenty-four (24) hours, after becoming aware of a Personal Data Breach affecting Client Personal Data, as Article 33(2) requires. Notification will be sent to the contact nominated in the Engagement.

8.2 The notification will contain, to the extent known at the time: the nature of the breach including, where possible, the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to mitigate adverse effects; and a contact point for further information. Where the full information is not available at once, it will be provided in phases without further undue delay.

8.3 The Processor will not notify a Supervisory Authority or any Data Subject in relation to a breach of Client Personal Data unless the Controller instructs it to do so, or it is independently required to do so by law. Assessing notifiability and making any notification under Articles 33 and 34 is the Controller's responsibility and decision.

8.4 The Processor will cooperate with the Controller, preserve relevant evidence, take reasonable steps to contain and remediate, and provide reasonable assistance with the Controller's investigation, notification and communications.

8.5 A notification under this clause is not an admission of fault or liability by the Processor.

9. Assistance with Articles 32 to 36

9.1 Taking into account the nature of the processing and the information available to it, the Processor will provide reasonable assistance to the Controller in ensuring compliance with its obligations under Articles 32 to 36 GDPR — security of processing, breach notification and communication, data protection impact assessments, and prior consultation with a Supervisory Authority.

9.2 Where such assistance falls outside the agreed scope of the Engagement, it will be scoped and charged as a separate workstream, notified to the Controller in advance.

10. Return and deletion

10.1 On termination or expiry of the Engagement, and at the Controller's election notified in writing, the Processor will delete or return all Client Personal Data and delete existing copies, unless Union or Member State law requires continued storage.

10.2 Where the Controller makes no election within thirty (30) days of termination, the Processor will delete the Client Personal Data in accordance with its standard schedule, having given a final reminder.

10.3 The Processor may retain Client Personal Data to the extent and for the period required by law, or where retention is necessary for the establishment, exercise or defence of legal claims. Retained data remains subject to the confidentiality and security obligations of this DPA, is processed for no purpose other than that retention ground, and is deleted once the ground falls away. Our standard professional-record retention position is set out in section 6 of the Privacy Notice.

10.4 Deletion means secure destruction such that the data cannot practicably be reconstructed. The Processor will certify deletion in writing on request. Data held in encrypted backup media is deleted in accordance with the backup rotation cycle and remains protected until overwritten.

11. Information, audit and inspection

11.1 The Processor will make available to the Controller all information necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by it.

11.2 In the first instance the Processor may satisfy a request under clause 11.1 by providing its current security documentation, completed security questionnaires, policy summaries, and any relevant independent assessment or certification it holds.

11.3 Where that is not sufficient to address the Controller's reasonable concern, the Controller may conduct an audit on at least thirty (30) days' prior written notice, no more than once in any twelve-month period except where a Personal Data Breach has occurred or a Supervisory Authority requires it. Audits take place during business hours, must not unreasonably disrupt the Processor's operations, and are subject to confidentiality obligations and to the protection of other clients' information, which will not be disclosed.

11.4 The Controller bears its own costs and the Processor's reasonable costs of supporting an audit, except where the audit identifies a material breach of this DPA by the Processor, in which case the Processor bears its own costs.

11.5 Any auditor mandated by the Controller must not be a competitor of the Processor and must enter into a confidentiality undertaking in a form reasonably acceptable to the Processor.

12. International transfers

12.1 The Processor will not transfer Client Personal Data outside the European Economic Area without the Controller's prior written authorisation and a valid Chapter V transfer mechanism.

12.2 Where a transfer is authorised, the parties will rely on an adequacy decision under Article 45 where one covers the destination, or otherwise will enter into the Standard Contractual Clauses, selecting the module appropriate to the relationship — ordinarily Module Three (processor to sub-processor) where the Controller is established in the EEA, or Module Two where the Controller is the data exporter. Where the SCCs are entered into, they are incorporated by reference into the Engagement and prevail over this DPA in the event of a conflict, as the SCCs require.

12.3 Where the SCCs apply, the parties will complete the Annexes using the information in clause 3 and clause 5, and the Processor will carry out and document a transfer impact assessment addressing the law and practice of the destination country concerning public-authority access, applying supplementary measures where the assessment indicates they are needed.

12.4 The Processor will promptly notify the Controller if it becomes subject to a legally binding request from a public authority for disclosure of Client Personal Data, unless prohibited from doing so, and will challenge requests that appear unlawful.

13. Liability and indemnity

13.1 Each party's liability under or in connection with this DPA is subject to the exclusions and limitations set out in the Engagement and in section 25 of the Terms of Service. Nothing in this DPA limits liability that cannot lawfully be limited.

13.2 Nothing in this clause limits or excludes the rights of a Data Subject under Article 82 GDPR, or the ability of a Supervisory Authority to exercise its powers.

13.3 Where one party has paid compensation under Article 82(4) for damage for which the other party is also responsible, it is entitled to claim back from that other party the part of the compensation corresponding to that party's share of responsibility, as Article 82(5) provides.

14. Term, variation and general

14.1 This DPA takes effect on the commencement date of the Engagement and continues for as long as the Processor processes Client Personal Data on the Controller's behalf. Clauses 4.3, 10, 11 and 13 survive termination.

14.2 The parties will negotiate in good faith any variation required by a change in applicable data-protection law, by guidance from the European Data Protection Board or a Supervisory Authority, or by a decision of a competent court. The Processor may update this published version to reflect such changes; an executed DPA is varied only by written agreement between the parties.

14.3 If any provision is held invalid or unenforceable, it will be modified to the minimum extent necessary and the remainder continues in force.

14.4 This DPA is governed by the laws of Ireland, and the dispute-resolution provisions in section 30 of the Terms of Service apply, save where the SCCs require otherwise.

15. Contact

Requests for the Sub-processor list, the technical and organisational measures schedule, a signed counterpart of this DPA, or a copy of our transfer safeguards may be made through the contact page or in writing to DataFort Solutions Ltd., 12 Emerald Square, Dublin 4, Ireland.

Related documents: Terms of Service · Privacy Notice · Cookie Policy · Legal Centre