Knowledge
Request a demo
Regulatory & compliance⏱ ~1 minEU

DPA

Data Processing AgreementDatabehandleravtalePersonuppgiftsbiträdesavtalDatabehandleraftale

The data processing agreement GDPR Article 28 requires between a controller and a processor - regulates what the vendor is allowed to do with personal data.

Definition

A DPA (Data Processing Agreement, in Norwegian databehandleravtale) is a legally binding agreement GDPRGeneral Data Protection Regulation - EU's data protection regulation, applicable in Norway via the EEA Agreement. Article 28 requires whenever a controller (e.g. a power company) lets a third party (the processor, e.g. a software vendor) process personal data on its behalf. The agreement specifies the purpose of the processing, which data is involved, how long it is retained, which security measures apply, and what happens to the data when the agreement ends. Without a signed DPA, the processing is in principle unlawful under GDPR, regardless of how strong the technical security measures are.

See also:GDPRISO 27001
RegulationSecurity

See also:

Regulatory & complianceGDPR →

General Data Protection Regulation - EU's data protection regulation, applicable in Norway via the EEA Agreement.

Regulatory & complianceISO 27001 →

International standard for information security management systems - provides framework for protecting sensitive information.

You might also like

Regulatory & complianceEmergency Preparedness Regulation →

Norwegian regulation setting requirements for emergency preparedness and security of the power supply.

Regulatory & complianceCER Directive →

EU directive on resilience of critical entities - sets requirements for protecting critical infrastructure against physical threats.

Regulatory & complianceInternal control →

A documented system showing that an organisation actually complies with the requirements it is subject to. Mandatory for KBO units under section 2-10 of the Norwegian power emergency preparedness regulation.

Regulatory & compliancePower-sensitive information (KSI) →

Concrete and detailed information about the power supply that can be used to harm it. Subject to a duty of confidentiality under the Norwegian power emergency preparedness regulation, section 6-2.