GDPR requires one whenever another organisation processes personal data for you. The agreement has to cover the subject matter and duration of the processing, its purpose, the categories of data and people involved, the security measures in place, the rules for engaging sub-processors, how the processor will help you respond to individuals exercising their rights, breach notification, and what happens to the data at the end of the contract.
The controller and processor distinction is worth getting straight. If you run a clinic and decide what data to collect and why, you are the controller. A software vendor that stores and processes it under your instructions is the processor. Both have obligations, but the controller carries the primary responsibility to visitors and customers — which is why the agreement exists.
Practically, most reputable vendors publish a standard DPA you can review and accept during signup rather than negotiating from scratch. When you adopt any website tool that captures enquiries, ask for it early and add it to your records alongside your privacy notice. It sits naturally beside the other questions to raise: SOC 2 status, encryption, retention and where the data lives.
Related terms
Browse all 104 terms- Service level agreementA service level agreement (SLA) is a documented commitment to a defined standard of service, such as how quickly you will respond or how much uptime you guarantee, usually with agreed consequences if it is missed.
- Data RetentionData retention is the policy and practice of deciding how long you keep each type of data before deleting it, based on how long you actually need it and what the law requires or permits.
- Data ResidencyData residency refers to the country or region where an organisation's data is physically stored, and to any requirement that it stay within a particular jurisdiction.
- No-ShowA no-show is a booked appointment where the customer never turns up and never cancels, leaving the slot empty and unsellable. It is different from a cancellation, because a cancellation at least gives you time to refill the time.