Data Processing Addendum (DPA) Framework

For customer-controller / Wisdsol-processor arrangements, the DPA should document:

• subject matter, duration and purpose of processing;
• categories of personal data and data subjects;
• documented processing instructions;
• confidentiality obligations;
• security measures;
• subprocessor controls;
• assistance with data-subject requests;
• breach and regulatory assistance;
• international transfer safeguards where applicable;
• audit/evidence arrangements; and
• return/deletion of data at termination.