Data processing agreements come attached to most vendor deals that touch personal data, and they often arrive with a request to sign the vendor's standard form as-is. The problem is that the standard form assumes a set of facts about the relationship that may not match what's actually happening with the data. Whether your company is a controller or a processor for a particular data flow shapes much of what follows, including what the processing instructions have to say, which transfer mechanism applies, and who carries the cost when a data subject request or a subprocessor breach shows up. Sorting those questions out before you start redlining tends to save a fair amount of rework later.
In this webinar, Laura Frederick, Robby Reggers, and Marta Hovanesian will walk through the GDPR concepts that come up most often in DPA and vendor negotiations and how they translate into contract terms. They'll cover how to classify each data flow, when joint controllership attaches, and why the labels the parties write into the contract don't control the analysis. From there, the speakers will take a close look at the Article 28 required content and how to draft documented processing instructions that hold up once real operations start. The discussion will also cover selecting the right SCC module and layering the DPA over the SCCs without creating conflicts, scoping data subject rights assistance including response timelines and who pays for the compliance help, and subprocessor approval mechanics, flow-down terms, and how liability sits when a subprocessor causes the breach.
*Live CLE Credit Information:
How to Contract will apply for 1.25 hours of General CLE credit in TX.
This program is approved for the following:
1.25 hours of General CLE credit in California
1.00 hours of Substantive CLE credit in Pennsylvania
We will provide details to attendees on how to request a certificate of attendance. These certificates are provided after an attendee submits a completed credit request form (including the CLE code words shared live) within 14 days of the live webinar. Late submissions are not accepted.
Lawyers in these other jurisdictions who attend live may be eligible for credit through reciprocity, self-application, or reporting: AK, AL, AR, AZ, CT, CO, FL, GA, HI, IA, ID, IN, IL, KY, LA, NC, NH, NJ, NV, NY, MD, ME, MN, MO, MT, NC, ND, NE, NH, NM, NV, OK, OR, RI, SC, TN, UT, VA, VT, WA, WI, WV, and WY. These programs may also be eligible for Canadian CPD credit in British Columbia, Ontario, and Quebec.
We do not determine individual eligibility. Please check your state bar for specific compliance rules.
