The General Data Protection Regulation (GDPR) is the toughest privacy and security law in the world. Though it was drafted and passed by the European Union (EU), it imposes obligations onto organizations anywhere, so long as they target or collect data related to people in the EU. The regulation was put into effect on May 25, 2018. The GDPR will levy harsh fines against those who violate its privacy and security standards, with penalties reaching into the tens of millions of euros.

With the GDPR, Europe is signalling its firm stance on data privacy and security at a time when more people are entrusting their personal data with cloud services and breaches are a daily occurrence. The regulation itself is large, far-reaching, and fairly light on specifics, making GDPR compliance a daunting prospect, particularly for small and medium-sized enterprises (SMEs).

A data processing agreement is a legally binding contract that states the rights and obligations of each party concerning the protection of personal data. If your organization is subject to the GDPR, you must have a written data processing agreement (DPA) in place with all your data processors. Yes, a data processing agreement is more annoying paperwork. But it’s also one of the most basic steps of GDPR compliance and necessary to avoid GDPR fines.

Zero Friction take the data processing security of the data it is processing very seriously.

For this reason we sign a Data Processing Agreement with all our customers

Here are the templates for the DPA:

As the Microsoft Azure Cloud is used for the Zero Friction application, Microsoft is a sub processor. More information on the Microsoft GPDR Policies can be found here:

Microsoft General Data Protection Regulation Summary