Terms of Data Processing

DPAs between controllers and processors ensure they both understand their obligations, responsibilities, and liabilities.

DPAs also help them comply with various regulations, such as the GPDR, and help demonstrate compliance to regulators and individuals.

The answer varies depending on the jurisdiction and subject matter involved, but there are certain elements that should always be included in a DPA:

First, DPAs must define:

• the subject matter and duration of the processing;
• the nature and purpose of the processing;
• the types of personal information and categories of data subjects; and
• the controller’s obligations and rights.

Second, DPAs must also include specific terms or clauses regarding:

• processing only on the controller’s documented instructions;
• the duty of confidence;
• appropriate security measures;
• using sub-processors;
• data subjects’ rights;
• assisting the controller;
• end-of-contract provisions; and
• audits and inspections.

The ideas of data ownership and confidentiality are specific to Carrot’s standard contracting process, which, because of the sensitive nature of the services Carrot and our partners provide, is designed to be very pro-user.  As a result, we cover a lot of ground related to data (such as restrictions on use and obligations in the event of a security incident) in the service agreements we enter into with customers.  

When we have reviewed customers' DPAs, we often find that these contain provisions that overlap with what the service agreement already contains.  We also find that other DPAs describe ownership in ways that conflict with how the service agreement outlines them, which makes the documents difficult to read together.  Our DPA is already tailored both to the coverage of our MSA and to the specifics of data ownership, as they apply to us.

It is common for the same entity to be considered a controller in one context and a processor in another context. This is the case for Carrot.

Under the GDPR:

• A "data controller" is an entity that determines the purpose and means of the processing of personal data.
• A "data processor" is an entity that processes personal data on behalf of a data controller.

In the context of the DPA, Carrot is acting as a processor because it is processing personal data on behalf of a controller (i.e. the customer). The customer sends Carrot an Employee Eligibility File ("means") for the "purpose" of confirming which employees are eligible for the Service. Carrot then processes this data on behalf of the customer and in accordance with the customer's instructions (i.e., to confirm eligibility).

In the context of the Privacy Notice, on the other hand, Carrot acts as the controller when members (i.e, employees whose eligibility has been confirmed) sign up directly for the Service through the Platform. Here, Carrot determines the purpose (i.e, providing the Service) and the means (i.e, collecting personal data from members through the Platform) of processing personal data. The Privacy Notice governs the relationship between Carrot (the controller) and individual members (the data subjects).