In Cenedril you set your data processing agreement under Art. 28 GDPR once as a template and approve it. For every processor you offer this agreement to, the DPA Generator fills in the parties, the connected processing activities and the applied TOMs. You provide the finished agreement to the processor in the portal. The processor enters its subprocessors there and signs electronically, after which the agreement is documented as concluded in Cenedril.
Set and approve the template
Open the template
In the Data Privacy Assistant, open the step Policies & Procedures. The section Documents as controller holds the template Data processing agreement for your processors. Expand the card.
Set the contract details and the text
Under Contract details you set whether a main agreement with the processors exists, such as a service or framework agreement, and its name. The Lead time for changes of subprocessors sets how far in advance a processor must announce a new subprocessor to you. With Edit text you adapt the agreement section by section.
If details are missing, such as your organisation’s address, the yellow list above the agreement names them with a link to the matching question. The DPA Generator later fills in the processor’s name and address.
Complete and approve the template
Save the template with Complete. The version then moves into document control, where you approve it in the Documentation. The DPA Generator uses the approved version in the respective language. The guide on policies and procedures describes how approval works.
Mark the processor
Set the DPA status “Contract offered”
In the step Data transfers, open the external recipient you offer your agreement to and choose Contract offered as the status of the data processing agreement. Publish the data transfers.
Cenedril then creates the task Create the contract for … with the recipient’s name. It leads straight to the DPA Generator with the recipient selected. If the status changes later, for example through the signature in the portal, the task closes itself.
Generate the agreement
Open the DPA Generator
Open the generator from the task, or in the overview of the Data Privacy Assistant via Data Processing Agreements. The DPA Generator page shows a notice at the top that it does not constitute legal advice. Under Select your role for this DPA: keep Generate as Controller selected.
Select the processor and check the data
Under Select processor (DPA status “Contract offered”): choose the recipient. The page shows the Connected Processing Activities and, under Applied Controls (TOMs), the measures that go into the agreement. If something is missing, add it in the Records of Processing Activities or in the steps Data transfers and Technical & Organizational Measures.
Check the agreement in the preview
Under Generated DPA Preview you see the agreement built from your approved template, with the processor as a party and the annexes. The language toggle switches between German and English. If no version of the template has been approved in a language yet, the button Go to the template in Policies & Procedures leads there.
If the processor’s address or contact is missing, the clause that would name it is left out of the agreement. Annex 3 refers to the list of subprocessors the processor provides with the agreement.
Have it signed in the portal
Provide the agreement in the portal
Below the preview, in the area Provide in the portal, click Provide agreement in the portal. Cenedril creates a link and a PIN, and the status reads Waiting for the processor. The PIN is shown only at this moment. Pass on link and PIN separately, for example the link by email and the PIN by phone.
As long as the processor has not signed, Provide again provides the agreement with its current text and replaces link and PIN. New PIN replaces only the PIN, and Withdraw removes the agreement from the portal. Providing and withdrawing are recorded in the activity log. If you prefer to distribute the agreement yourself, copy it with the copy icon next to the preview.
The processor signs
The processor opens the link, enters the PIN and reads the agreement. Under Subprocessors (Annex 3) it confirms that it engages none, or enters them with country, purpose and transfer mechanism. Under Who signs? it gives name, role and email address and continues with Continue to signing. There it confirms the signature with a code sent to that email address.
Check the concluded agreement
After signing, the area in the DPA Generator shows Signed with signatory and date. The DPA status of the recipient under Data transfers reads Signed/Confirmed, and the task for the agreement is done. The agreement is kept as a record and appears under Documents with Signatures.
In the Documentation, the card Concluded data processing agreements opens the register with signatory, date and signed PDF. The filter Processors (signed in the portal) separates these agreements from the customers who concluded your standard data processing agreement in the Trust Center.
As a processor
Generate a DPA for a controller
If you process data on behalf of a controller yourself, choose Generate as Processor and, under Select Controller you provide services for:, the organisation. The list comes from the activities in the record where you are recorded as processor. Annex 3 names your subprocessors. Copy the draft to your clipboard with the copy icon.
Result: your data processing agreement is approved as a template, the processor has signed it in the portal, and the agreement is listed with signatory, date and signed PDF in the register “Concluded data processing agreements”. The DPA status under data transfers reads “Signed/Confirmed”.