Roles and instructions
The agreement must identify controller and processor roles, purposes, data categories, subjects and documented instructions.
Data processing information
Processing responsibilities must be agreed before customer data enters a managed service.
This page explains the intended contract structure; it is not a signed data processing agreement and requires legal review for each production service.
Subprocessors and location
Production vendors, processing regions, transfer safeguards and notification procedures must be listed and kept current.
Security and incidents
Access, encryption, backups, logging, incident cooperation and breach-notification duties need concrete operational commitments.
Retention and exit
Deletion, return, exports, legal retention and transition assistance must be defined for contract end and account deletion.