Write a data processing requirement #

Who: the procurement officer with the data protection officer. When: while drafting the requirements. The facts come from Privacy standards.

Note This page describes features and common practice; it is not legal advice. Check the law that applies to your organization with your legal counsel. EU: GDPR.

Contents #

1. Before you start
2. Steps
3. Example
4. Result
5. Pitfalls

Before you start #

• List the personal data the site will hold: accounts, form submissions, newsletter subscribers, logs (Privacy checklist).
• Know what the software provides: consent log, opt-in mail categories, erasure on account removal, log masking and retention settings; and what it lacks: no "export all my data", no cookie banner (Privacy standards).

Steps #

1. Identify the processors: host, support supplier, any third-party service. Each signs a processing agreement.
2. State data location for production, backups and support access.
3. Forbid unannounced third parties: no extension that sends visitor data to a third party (analytics, CAPTCHA, social login, AI provider) without your written approval (Privacy standards).
4. Set retention: forms, logs (the kernel's general logs have no age limit by default), backups, audit records.
5. Require support for individuals' rights: the supplier documents how to find and export or erase a person's data across accounts, forms and newsletters, since there is no single function.
6. Require no personal data in test, development or training copies.
7. Require return and deletion at the end (Personal data at exit).

Example #

DP-01  The Supplier acts as processor under a processing agreement in the form of Annex <x>.
DP-02  Production data, backups and support access remain in <location>.
DP-03  No component that transmits personal data to a third party is activated without <body>'s prior
       written approval; the Supplier lists every such component in the <period> report.
DP-04  Retention: form submissions <period>; logs <period>; backups <period>; audit records <period>.
DP-05  The Supplier documents and tests a procedure to export and erase one person's data within <time>.
DP-06  Test, development and training copies contain no personal data from production.

Result #

Requirements that make the data flows explicit and checkable, matched to what the software can do.

Pitfalls #

• Assuming the software is "GDPR compliant": the organization is the controller.
• Forgetting backups and logs in retention rules.
• Activating an analytics extension without consent and a notice.

Related pages #

• Procurement and training tasks
• Privacy and data protection requirements
• Privacy and data processing clause
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.