Check with the SaaS provider to see whether you have the option to determine where your personal data is stored and if you can implement a data localization policy. Ideally, you will want to ensure your data stays in the UK or EU to avoid the international transfer restriction (see Article 46 of the GDPR). Location of Origination and Transfer of Data However, if the processor is for example handling payroll across your organization you are likely to review the DPA more carefully. If for example the only data being exchanged are low levels of contact data of several employees within your organization, you may not need to spend much time reviewing the DPA.

It’s always good to read through this first and check this through with the business for accuracy so that you can take a view as to how great the data protection risk is. What technical measures are in place to protect the data?įortunately, this level of information is usually set out in a table at the back of a DPA, the details of which are required under Article 28 of the GDPR.For how long will the data be processed?.What category of data subjects are involved?.How much personal data is being transferred and for what purpose?.Its always good to get a handle from the outset of a transaction and understand the following: This article is split up into two parts and looks at the more densely negotiated controller-processor relationship and some of the key negotiation points parties often encounter in the DPA, with my go-to negotiation tips for customers/controller. That’s why it is imperative to pay particular attention to data protection issues where personal data is involved. The consequence of non-compliance with these data privacy laws is large administrative fines and significant reputational harm. In my capacity as a technology lawyer, I’ve created a similar mental process when reviewing Data Protection Agreements (DPA) that are frequently attached to SaaS agreements.Īs a lawyer based in the UK, the majority of deals I work on involve the exchange of personal data between counterparties governed by the Data Protection Act 2018, UK GDPR, or EU GDPR. In a way, we all work through checklists when approaching new tasks. Fortunately, this thought process proved that I was not that much of a risk and helped me land my first job as a paralegal, prior to my training contract. termination, liability, and services before deciding on whether to sign. In one of my first interviews after leaving law school I was asked by several interviewers, “If you had 10 minutes to review an agreement, what would you do?”Īfter some carefully bought time sipping water, pausing, contemplating, and putting my thoughts together, I laid out a very simple roadmap that goes to the heart of every contract-specifically reviewing high-risk areas of the contract i.e.

Issue checklist pro