Data Processing Agreement UK/EEA – Scottish Law

In the digital age, data is an invaluable asset but also a liability if mishandled. As a business that may process personal data for clients, it’s crucial to have a robust Data Processing Agreement (DPA) in place. This version is under Scottish Law.

What is a Data Processing Agreement?

A DPA is a legally binding document between a Data Controller (your client) and a Data Processor (you) that outlines how to handle and secure personal data in accordance with the law.

Key Features in this DPA Scottish Law:

• Strict Compliance: This DPA is compliant with the General Data Protection Regulation (GDPR) and drafted under the jurisdiction of England & Wales. It’s suitable for processing taking place within the UK or the European Economic Area (EEA).
• Written Instructions: The Processor can only process data based on the Controller’s written instructions.
• Confidentiality: All personnel dealing with the data must maintain confidentiality.
• Security Measures: The document mandates the use of all appropriate technical and organisational measures to protect data.
• Sub-Processing: Subcontracting to another processor is permissible only with written consent from the controller and necessitates another DPA.
• Assistance in Compliance: The Processor agrees to assist the Controller in upholding GDPR obligations and consulting with data protection authorities for high-risk processing.
• Data Return or Deletion: Upon termination of services, the Processor will either return or delete all personal data.
• Governing Law & Jurisdiction: The agreement is under Scottish law and jurisdiction.

Format and Edits:

• You will receive the DPA in a Word document, making it easy to customise. Once downloaded you can use it as many times as you need to in your own business.
• Please note: Do not remove our name from the footer. The download link will expire in 30 days so make sure you save the document to your computer or device.

Download Limits for the DPA Scottish Law:

• Limited to 3 downloads.
• Expires after 30 days if not used.

Extra Information:

• Visit the ICO’s website if you’re uncertain whether you process personal data.
• An annual registration fee to the ICO may apply to your business.

Take proactive steps to protect both your business and your client’s data. Secure your DPA today!