Data processing agreement

1. Scope and instructions

The customer is controller or a processor authorized to appoint EMT; EMT acts as processor or subprocessor for agreed services. The order annex must describe subject, duration, data subjects, data types, nature, purposes, regions and operations. Processing follows documented instructions, including transfers, unless law requires otherwise, with notification where permitted.

2. Confidentiality and security

Access is limited to authorized personnel bound to confidentiality. Agreed measures must describe access controls, tenant isolation, credential protection, relevant encryption, logging, vulnerability management, continuity and tested restoration. EMT informs the customer if it considers an instruction contrary to data protection law.

3. Subprocessors and transfers

Subprocessors require the specific or general authorization established by the agreement. Under general authorization, changes must be communicated with agreed notice and an effective opportunity to object. Equivalent obligations must bind subprocessors; EMT retains the responsibilities set by GDPR Article 28.

The parties verify locations, support access and instruments for international transfers before execution. An EEA node alone does not exclude other transfers.

4. Assistance and incidents

Taking account of processing and available information, EMT assists with data subject requests, security, impact assessments and prior consultations. Personal data breaches are reported to the customer without undue delay after awareness, with available information and subsequent updates. Emergency contacts and escalation channels must be included in the operational annex.

5. Return, deletion and verification

On termination, data is returned or deleted at the customer’s choice, unless law requires retention. The agreement must define export windows, backup copies, deletion periods and evidence. EMT makes compliance information available and permits agreed audits and inspections while protecting other customers’ data.

Required annexes

Before commercial use: party identities and contacts; workloads and data subjects; data types and sensitivity; instructions and regions; technical and organizational measures; authorized subprocessors; transfers and safeguards; retention; incident and deletion procedures. This page does not certify executed third-party agreements or qualification for every data category.