Data Processing Agreement

Template — review with your legal counsel before publishing.

1. Roles

For most personal data we process under our certification services, we act as an independent controller under our accreditation obligations. Where we process personal data on your behalf (e.g. evidence files containing employee data), we act as processor.

2. Subject matter & duration

Subject matter: personal data submitted via the certification platform (evidence, audit records, communications). Duration: for the term of the agreement plus any retention required by accreditation rules.

3. Nature & purpose

Storage, retrieval, review, sharing with auditors and (where applicable) accreditation bodies, deletion.

4. Categories of data

Identity and contact data, employment data, training records, incident data, and any other personal data the client uploads as evidence.

5. Sub-processors

We engage vetted sub-processors (cloud hosting, email delivery, monitoring). A current list is available on request and we provide reasonable notice of changes.

6. Security

RBAC, encryption in transit, audit logging, least privilege, secure backups, breach notification within 72 hours of awareness.

7. International transfers

Where transfers occur outside the UK/EEA we rely on adequacy decisions or UK IDTA / SCCs.

8. Data subject requests

We will assist you to respond to data subject requests within agreed timelines.

9. Audit

We provide compliance documentation on request. On-site audits may be arranged subject to reasonable scoping and confidentiality.