External parties and transfers
Onboard and approve a processor
Assess a proposed processor, document sufficient guarantees, and establish the agreement before any personal data is disclosed.
Before a cloud analytics vendor receives a single record from a manufacturing client, the vendor has to exist in the workspace as an assessed entity with an agreement in place. Nothing should flow ahead of that approval.
This is exercised at procurement: the guarantees the vendor offers are recorded against the entity, the agreement is held as evidence, and only then is the vendor linked to the activities it will support.
The proof is that no activity names a processor with no agreement attached, and that the approval can be read back to the assessment that supported it.
- Regulation
- Article 28
- Registers
- Entity · Agreement · Processing activity · Measure · Risk
The steps
- 01Open the Entities register and use the plus button beside the register title to create the processor entity.
- 02On the Assessment tab, record the guarantees offered, security certifications, subprocessing policy and audit rights.
- 03Open the Linked records band and use "Link a record" to attach the processing agreement.
- 04Move the entity from Draft to Approved on the lifecycle bar once the agreement is in place.
- 05Open each activity the processor will support and use "Link a record" to attach it.
Accepted when
- An activity naming a processor with no agreement is reported as a gap.
- Approval is readable back to the assessment that supported it.
Documents that carry the evidence
- DPA · Data processing agreement
- The processor contract, with the instructions, confidentiality, security, subprocessing, assistance, return and audit terms Article 28(3) requires.
These templates are issued when the register opens, so the document exists before the record that cites it.