Partners, agreements and responsibilities
Under Partners you maintain every company you have a relationship with around the processing of personal data. Before the interface makes sense, it is worth looking at the underlying roles: they determine which agreement type you pick.
Controller and processor
Section titled “Controller and processor”Personal data, whether from customers, users or employees, can be processed in two ways:
- yourself, or
- outsourced to another company.
And it works in both directions: you can just as well process data on behalf of another company.
That produces the roles:
| Role | Meaning |
|---|---|
| Controller | The company that “owns” the data and is ultimately answerable for its safety |
| Processor | The company that processes data on behalf of the controller |
| Joint controllers | Two companies that jointly determine purposes and means of processing |
Which agreement type you need depends on the direction. If you use another company’s service (your data, their infrastructure), it is a data processing agreement. If you share responsibility for the same data, it is a joint controllership agreement.
Creating a partner
Section titled “Creating a partner”A partner consists of master data and agreements.
Basic data: name, country, city, address and a description.
Contacts: name, email and phone of their data protection officer plus a general contact person with email.
The country is more than an address detail: if the partner sits outside the EU or EEA, that is the first indication that a third country transfer needs to be documented in the associated processing activities.
The partner header counts how many joint agreements and how many data processing agreements are on file.
What is an agreement in the DPMS?
Section titled “What is an agreement in the DPMS?”An agreement in the DPMS governs which data the partner may process for what purpose.
There are usually two kinds:
The general agreement. The provider’s standard document governing the terms as a whole. With Microsoft, for instance, the official Data Protection Addendum, which can be downloaded from the provider and stored here. It defines the terms, the data collected and the obligations on both sides. It is therefore the basis from which you later pick the relevant subset per processing activity.
Specific agreements. Additional arrangements for individual activities. A partner can have several, one for each aspect of the cooperation. These you assign to specific processing activities.
Typical reasons for a dedicated agreement:
- Email and collaboration services
- External payroll processing
- Outsourced customer support
- IT support and remote maintenance
- Recruitment services
- CCTV monitoring
- Payment processing
Fields of an agreement
Section titled “Fields of an agreement”| Field | Note |
|---|---|
| Name | Mandatory |
| Agreement type | Mandatory: General, Joint controllership agreement or Data processing agreement |
| Signing date | When it was signed |
| Valid until | End of term |
| Agreement | The document as a file upload |
| Description | Free text, e.g. the scope of the arrangement |
Set the agreement type correctly the first time: when editing an existing agreement, the agreement type field is locked. Changing it afterwards is not supported. When in doubt, create the agreement anew.
Without stored agreements, the link to the individual processing activity is missing. That link exists only once an agreement is on file.
Assigning agreements
Section titled “Assigning agreements”An agreement takes effect in two places:
- At register level: in the agreements tab of the RoPA. This documents the contractual basis on which the register as a whole is maintained. That matters particularly when you process data on behalf of another company: the entire register then rests on the arrangement with that company.
- At processing activity level: in the agreements tab of the activity. Here it becomes concrete which agreement covers this specific processing.
Together, both assignments form the chain partner → agreement → processing activity → legal basis.
Limits
Section titled “Limits”- No link to the controller information. The fields under controller information in the register are free text and do not draw on the partner master data. Details about your own company are therefore maintained again per register.
- No automatic deadline monitoring. Valid until is documented but not monitored: there is no reminder for expiring agreements.
- No partner register as a report. An exportable overview of all partners with agreement status is not available.
See also Scoping RoPAs and processing activities and DPMS step by step.