Guides / Data processing agreement (databehandleraftale) for Django hosting, with Django Cloud
Peter van Doorn
Data processing agreement (databehandleraftale) for Django hosting, with Django Cloud
Nordic clients, public bodies and larger companies will ask the same thing before they sign: "Do we have a data processing agreement with the host?" In Danish that is a databehandleraftale, in Swedish a databehandlaravtal. This guide explains what it is and what to check. It is general information, not legal advice.
What a DPA is
If your client (the controller) lets another company (the processor) handle personal data on its behalf, GDPR Article 28 requires a written contract. Your hosting provider is a processor if personal data sits on its systems. So is any service your app sends personal data to.
Who is whose processor?
- You build and host for a client: the client is the controller. You are a processor. The hosting provider is your sub-processor.
- The client hosts in their own cloud account: the cloud provider is the client's processor, and you only need a contract for your own access.
Both chains need contracts. Ask the client which structure they want before you sign anything.
What the agreement must contain
At minimum, Article 28(3) expects the contract to say:
- What the processing is, how long, and which data and people it concerns.
- That the processor acts only on the controller's documented instructions.
- That staff with access are bound by confidentiality.
- That appropriate security measures are in place.
- When and how sub-processors may be used, and that the controller is told of changes.
- How the processor helps with data subject requests.
- How data is deleted or returned at the end.
- How the controller can audit.
- That the processor reports a personal data breach without undue delay.
Questions to ask your host
- Is there a standard DPA, and is it signed online or by hand?
- Who are the sub-processors, and where are they located?
- Where is the data stored?
- How are breaches reported, and in what time?
- What happens to the data when the contract ends?
Practical tips for Nordic projects
- Keep the list of sub-processors in your own documentation, in one place, with the date it was checked.
- Public-sector clients often have a template of their own. Offer to use it.
- Tell the client early if you use US-based tools such as error tracking, so they can decide.
The Django Cloud Data Processing Agreement describes how we process personal data on your behalf and lists our sub-processors.
Or skip it
Django Cloud publishes a Data Processing Agreement under GDPR Article 28 that lists our sub-processors, and you can run your app in a European AWS region of your choice.
pip install djangocloud-cli
djangocloud deployFree plans are available for students, AWS Activate startups, open-source, non-profit and research projects. See how Django Cloud compares with other ways to host Django.
Django is a registered trademark of the Django Software Foundation. Django Cloud is not affiliated with or endorsed by it. Found a mistake in this guide? Tell us and we will fix it.