-
Review the DPA with your lawyer.
-
Prepare your DPA Setup Page (example).
- Identify the parties, DPA Effective Date, Subprocessor List and other Key Terms.
- Propose any Additional Terms (additions to or modifications of the DPA).
-
Prepare your Schedules (examples).
-
Send your DPA Setup Page (and Schedules) to your Counterparty.
-
Negotiate the DPA Setup Page and Schedules.
-
Sign the DPA Setup Page and create your DPA!
-
Add the DPA as an Attachment to the Agreement you created using the Cloud Terms.
- Add a reference to the DPA under Attachments on your Cloud Terms Cover Page (if executing concurrently)(see example); or
- Amend your Agreement to add the DPA as an Attachment.
FAQs for the DPA
What data transfers is the DPA generally designed to cover?
- The DPA is generally designed to cover a U.S.-based Provider (processor) interacting with a U.S. or global Customer (controller or processor) uploading personal data from U.S. or E.U. data subjects as part of its Customer Data under the Cloud Service.
How is the DPA structured between the main body and Schedules?
- The main body of the DPA is designed to generally cover E.U./U.K. GDPR, Swiss and common U.S. state law data privacy principles. Cross-border transfers and U.S. state and other jurisdiction-specific issues may be addressed by the parties on Schedule 3 (Cross-Border Transfer Mechanisms) or Schedule 4 (Region-Specific Terms).
Why are the DPA Schedules provided as "examples"?
- Because the Schedules must be customized to reflect the particulars of the transaction, and given the flux in the regulations themselves, we provide Schedules to the DPA under the Resources tab as “examples” in Word. You are free to create your own Schedules or start from the Bonterms examples and modify as you see fit.
What data transfers is the DPA not designed to cover?
- The DPA is not designed to cover Provider’s use of personal data in its capacity as a controller (such as registration data) nor controller-controller transfers.
Can I use the DPA without using the Cloud Terms?
- The Bonterms DPA is an Attachment to the Cloud Terms. This means it uses terms defined in the Cloud Terms (such as Affiliate, Agreement, Cloud Service, Customer Data, Order and Subscription Term) and relies on the larger contractual structure of the Cloud Terms (see, for example, the introduction to and Section 2.4 of the DPA and Sections 1, 5.3, 14.4, 16.5 and 22.10 of the Cloud Terms). Using the Bonterms DPA with a different underlying agreement would require a legal analysis of the differences with that agreement and, if a decision is made to proceed, drafting of any necessary corresponding provisions through a DPA Setup Page or other addendum.
Will the DPA work for my particular circumstances?
- To understand if the DPA will work in any particular circumstance you should consult with a U.S. or global privacy lawyer, as applicable.
Video walkthrough of How to Use the Bonterms DPA:
Updated