Data processing agreement

Using a cloud platform for customer service means handing personal data to a provider: names, conversation content, recordings, transcripts. The GDPR allows this when a contract clearly defines the roles.

#Two roles

• Controller: decides on the purposes and means of processing. Usually this is the company offering the customer service.
• Processor: processes data on the controller's behalf and instructions, with no purposes of its own. The platform provider, for example.

Towards customers and the supervisory authority, the controller remains responsible. So it has to choose its provider carefully, look for sufficient guarantees and bind the provider by contract.

#What the contract must contain

Art. 28(3) GDPR lists the minimum content. If any of it is missing, the contract has gaps.

#Sub-processors

Hardly any service runs without subcontractors: data centres, telephony, transcription, support. Engaging them requires the controller's prior authorisation, either specific or general.

With general authorisation, the processor must announce intended changes so that you can object. Check where sub-processors are located as well; that touches on data residency.

#DPA and DPIA

The DPA settles who may do what. It does not answer whether a processing operation is risky. That is the job of the data protection impact assessment, to which the provider contributes documents.

#The DPA with Univerx

Univerx processes your customers' data as a processor. The contract under Art. 28 GDPR, the technical and organisational measures and the list of sub-processors are available on request.

Details are in the Trust Center under GDPR; for an overview of operating in Europe, read the guide Running a contact centre in Europe.