dataavtale

A dataavtale is a contractual agreement that governs the processing of personal data between data controllers and data processors, or between organizations that share data. It defines the purposes of processing, the categories of data involved, and the duration of the processing. The arrangement helps ensure compliance with privacy laws, notably the GDPR in the European Union and the European Economic Area, as well as national implementations such as Norway’s Personal Data Act.

A dataavtale typically covers roles and responsibilities, descriptions of the processing activities, the lawful basis for processing, and requirements related to data subjects’ rights. It also specifies security measures, data retention and deletion obligations, sub-processors and flow-down terms, international transfers and safeguards, incident and breach notification, audit rights, liability provisions, and obligations to support data protection impact assessments when appropriate.

Legal context and purpose: under GDPR Article 28, a data processing agreement is required whenever a processor acts on behalf of a controller. Data transfers to non-EU/EEA countries require appropriate safeguards, such as standard contractual clauses, unless an adequacy decision exists. National implementations may add requirements for data localization, sectoral rules, or records of processing activities.

Practical considerations: organizations should use standard templates, conduct data mapping and DPIAs for high-risk processing, minimize data access, apply strong security controls, define retention and deletion timelines, and specify the handling of data at contract end. Regular reviews and supplier monitoring help maintain ongoing compliance.