Purpose of this page
This is not a signed data processing agreement. It explains the issues a customer and supplier may need to address when personal data is processed through a website, SaaS platform, implementation project or support relationship.
Controller and processor roles
The customer may act as controller for personal data it enters into a service, while the supplier may act as processor depending on the agreed service scope. Roles must be confirmed in the relevant agreement.
Documented instructions
Where processor obligations apply, processing should be limited to documented customer instructions, service operation, support, maintenance, security, troubleshooting, legal obligations and any other agreed purposes.
Security measures
Relevant agreements should consider access control, authentication, backups, hosting, logging, support access, incident handling, deletion, return of data and technical measures appropriate to the service.
Sub-processors
Third-party providers may be used for hosting, infrastructure, support, communication, security, analytics or operational tooling. Sub-processor information should reflect the live service and agreed contract.
Deletion and return
Customer data return or deletion should be handled according to the applicable agreement, lawful retention requirements, backup limitations and operational feasibility.
Customer instructions and configuration
Where a customer controls how the platform is configured and what information is entered, the customer remains responsible for ensuring the data is lawful, accurate, necessary and suitable for the intended processing. The supplier’s role should be limited to the agreed service and documented instructions where processor obligations apply.
Support access
Support or technical staff may need limited access to service information to diagnose issues, apply updates, investigate security events or assist with customer requests. Access should be controlled, proportionate and aligned to the service agreement.
Data protection impact assessments
Some AI governance uses may require the customer to complete a data protection impact assessment or other risk assessment. EUAIC can support records and evidence workflows, but the customer remains responsible for assessing its own processing and deployment context.