What is data processing agreement (verwerkersovereenkomst)? Meaning and explanation

Under Article 28 of the GDPR (AVG in Dutch), a controller must conclude a data processing agreement with every party that processes personal data on its behalf. The agreement records, among other things, which data is processed and for what purpose, which security measures apply, which sub-processors are used, how data breaches are reported and what happens to the data when the contract ends.

An accounting or bookkeeping firm processes a lot of personal data about clients and their contacts, such as names, addresses, IBANs and payroll data. As soon as the firm uses software that processes this data, it needs a data processing agreement with that supplier. During an inspection by the Dutch Data Protection Authority, or when clients ask, the firm must be able to show this is properly arranged.

Autoboeker offers a DPA. Sub-processors and security documentation are available in the Trust Center. According to its security information, data is encrypted in transit (TLS) and at rest (AES-256), access is role-based and can be set per administration, Autoboeker never sells or shares client data and data is not used to train public AI models.