DPA (data processing agreement)
A data processing agreement, or DPA, is the contract between a business that controls personal data and a supplier that processes it on its behalf, setting out what the supplier may do with the data and how it must protect it.
What it covers
Under the GDPR, processing by a processor has to be governed by a contract or another legal act. A DPA typically sets out the subject and duration of the processing, the kinds of data and of people concerned, the instructions the supplier follows, confidentiality, security measures, the use of sub-processors, help with guests’ rights requests, what happens to the data at the end of the contract, and audits.
A hotel signs one with each supplier that touches guest data and keeps them where the person who would answer a regulator can find them.
What Wizorks publishes
Under Wizorks’ terms, your hotel is the controller of its guests’ data and Wizorks is its processor. The data processing agreement is available on request from [email protected].