What is a data processing agreement, and when do we need one?

If you are the data controller and a supplier processes personal data on your behalf, a data processing agreement is required. It is not optional.

Who it applies to

The cloud provider, the system provider with access to production data, and the subcontractors they use. Microsoft has standard terms that cover this for Dynamics 365.

What it should say

What is processed, for what purpose, for how long, which security measures apply, and what happens when the agreement ends. Subcontractors must be listed.

Consultants count too

If a consultant is given access to the production environment containing real customer data, they are processing personal data on your behalf. This is often overlooked.

Use test data where possible

Using anonymized data for development and training eliminates much of the problem. It is easier than managing agreements for everyone who needs to view the data.