The Data Processing Agreement: The Contract the Law Requires With Every Provider That Touches Your Customers' Data

Why you need a processing agreement beside your privacy policy

Most small and medium businesses now rely on outside providers for daily work that never stops, and each of these providers sees personal data belonging to your customers or employees. Your privacy policy promises data subjects that their data is protected, but that promise is worth little if your provider is not bound by it in writing. The agreement is the tool that turns your public promise into a contractual obligation on whoever processes the data on your behalf.

• Payroll system or HR platform: employees' names, identity numbers, salaries, bank accounts and leave records.
• Cloud host: the full customer database, orders and backups.
• Marketing agency: email lists, mobile numbers and campaign engagement history.
• Delivery partner: the customer's name, address, mobile number and order details.
• Call centre: call recordings and complaint and account data.

In every one of these cases, the customer or employee still sees your business, not the provider. If their data leaks or is used for a purpose it was not collected for, your business is the first to answer to them and to the competent authority, the Saudi Data and AI Authority (SDAIA). The signed agreement is what proves you chose your provider with care and bound it to what the law binds you to.

Controller and processor: who you are and who your provider is in the eyes of the law

The law distinguishes between two parties. The controller is the party that determines the purpose and the means of processing personal data, and it is usually your business, because you collected the data and decided why it is used. The processor is the party that processes personal data for the benefit of the controller and on its behalf, meaning your provider, which carries out what you ask and does not decide for itself.

• Who decided to collect the data and for what purpose? That is the controller.
• Who stores the data, sends the messages or runs the payroll according to your instructions? That is the processor.
• Does the provider use the data for its own purposes, such as building its own customer base? Then it is no longer just a processor, and you need a different arrangement.

This distinction has an important practical effect. The Implementing Regulation treats a processor that breaches the controller's instructions or the agreement between them as a controller, responsible for violating the provisions of the law. In other words, a clear agreement does not protect only you. It draws limits for your provider, and if the provider crosses them it bears the consequences. Where the relationship is an exchange of data between two businesses that each decide their own purposes, the Data Sharing Agreement I-05 is usually the better fit rather than a processing agreement.

The required terms of the processing agreement: purposes, instructions and security

The Implementing Regulation requires the agreement with the processor to contain a minimum set of elements, including the purpose of processing, the categories of personal data, the duration of processing, the processor's duty to notify you of a leak, and the identification of sub-processors. A good agreement builds on this minimum and organises it into clear sections. These are the first sections, which set what the provider processes, why and how.

• Purpose and scope of processing: the specific service for which the provider processes the data, and a bar on any other use.
• Data categories and data subjects: which data is handed over, such as names, addresses and salaries, and about whom, such as customers, employees or job applicants.
• Duration of processing: when it starts and when it ends, linked to the term of the underlying services contract.
• Processor duties and instructions: that it processes only on your documented instructions, and that it notifies you in writing and without delay if it considers an instruction to breach the law, as the regulation requires.
• Confidentiality: binding every member of the provider's staff who sees the data to confidentiality, and limiting access to those who need it to deliver the service.
• Security measures: the technical and organisational controls the provider commits to in order to protect the data, such as encryption, access control and backups.

The operational terms: sub-processors, leaks, audit and deletion

The following sections govern what happens during the relationship and at its end, and they are the ones actually tested when something goes wrong. Your provider may itself use other providers: the payroll company may host its data with a cloud provider, and the marketing agency may use an outside messaging platform.

• Sub-processors: naming them in the agreement, and no new sub-processor without your prior approval after you are notified and given a chance to object, with each one bound to protection no lower than what was agreed.
• Breach notification to the controller: the provider's duty to notify you of any personal data leak without undue delay, with the details it has that help you meet your own obligations to the competent authority and to data subjects.
• Assistance with data subject requests: enabling you to respond to the access, correction and destruction requests you receive, and forwarding to you any request that reaches the provider directly. The DSR Response Pack I-06 helps you with your side of this process.
• Audit: your right to verify the provider's compliance periodically, which the regulation imposes on the controller as a duty, with the option of appointing an independent party to do it.
• Return or deletion at the end: returning the data to you or destroying it, including backups, as you choose, with a written confirmation.
• Term and liability: the agreement runs for as long as processing continues, confidentiality survives its end, and liability and indemnity are allocated between the parties for any breach.

Providers outside Saudi Arabia: what transferring data outside the Kingdom means

Many cloud systems and payroll and marketing platforms store or process data outside the Kingdom. The Implementing Regulation requires the agreement with the processor to state whether the processor is subject to the laws of other countries, and the effect of that on its compliance. Transferring personal data outside the Kingdom is subject to specific rules set by the Regulation on Personal Data Transfer outside the Kingdom, and SDAIA has published standard contractual clauses used as a safeguard when data goes to a country or organisation without an adequate level of protection.

• Ask your provider in writing: where the data is stored, where the sub-processors are located, and from which country technical support is run.
• Name the processing locations in the agreement, and require notice before they move to a new country.
• Before any transfer abroad, review with your lawyer the legal basis for the transfer and the right safeguard for it, because the transfer conditions are detailed and subject to updates.

When to sign the agreement and how to attach it to an existing services contract

The right time is before the provider receives any data, meaning when the services contract is signed or before the account on the platform is activated. If the relationship has been running for some time without an agreement, do not wait for renewal. Conclude the agreement as an annex to the current contract. There is no need to renegotiate the price or the scope of service, because the annex governs the data only.

1. List every provider that touches your customers' or employees' data, and record for each one the data it sees.
2. Decide for each provider whether it is a processor acting on your instructions, or an independent controller with which you need a data sharing agreement.
3. Ask the provider for its own agreement if it has one and compare it with the required elements, or offer it your agreement prepared from template I-04.
4. Sign the agreement as an annex to the services contract, stating expressly that it forms an integral part of it, and that its provisions prevail in everything relating to personal data in case of conflict.
5. Keep the signed copy in an organised record, and review it whenever the service, the sub-processors or the processing locations change.

The agreement is one link in a chain of connected documents. The privacy policy D-03 tells your customers that you use providers, the cookie notice D-04 covers the tracking tools on your website, the employee privacy notice E-17 tells your team that their data passes through the payroll system, and the processing agreement I-04 binds the provider to what you promised in all of these. The templates are certified drafts and a strong starting point, but they do not replace advice from your lawyer on a specific situation, and the Arabic text prevails in case of any difference.

Frequently asked questions