{"id":386,"date":"2018-07-30T10:32:15","date_gmt":"2018-07-30T10:32:15","guid":{"rendered":"https:\/\/isquaredemo.com\/MLT\/threegraceslegal\/practicalities-of-a-dpa\/"},"modified":"2018-07-30T10:32:15","modified_gmt":"2018-07-30T10:32:15","slug":"practicalities-of-a-dpa","status":"publish","type":"post","link":"https:\/\/isquaredemo.com\/MLT\/threegraceslegal\/blog\/practicalities-of-a-dpa\/","title":{"rendered":"PRACTICALITIES OF A DPA"},"content":{"rendered":"

\u00a0<\/p>\n

\"Practicalities<\/p>\n

Article 28 of the General Data Protection Regulation (GDPR) states the conditions of a data processing agreement between the data controller and the data processor.<\/p>\n

Recently, this agreement has been brought in to question, regarding its workability and whether it is actually working in the way it is prescribed in the GDPR requirements. https:\/\/gdpr-info.eu\/art-28-gdpr\/<\/a> <\/p>\n

Organisations are usually established as the data controller, and the program they use acts as the data processer, i.e. Microsoft One Drive<\/em> for Business<\/em>, which is utilised by various companies. In accordance with Article 28 of the GDPR, an organisation should have a controller-processor agreement with their chosen software, which would usually be dictated by the data processor.<\/p>\n

However, data controllers need to be able to assess processors regularly, usually through an audit. Although, Microsoft do offer risk assessment tools including audit reports that will allow efficient evaluations, other companies do not. Therefore, instead of conducting an audit, a data controller can conduct yearly checks on security certifications, and privacy statements, in order to assess the efficiency of the data processor.<\/p>\n

The ICO has recommended guidance on their website, including a data controller and data processor contract check list, which should include:<\/p>\n