DPA (GDPR art. 28) and DPIA (art. 35): real documents
The processing agreement and the impact assessment are read, downloaded and accepted with a fingerprint.
The channel processes special-category data (GDPR art. 9) on behalf of your organisation: a Controller–Processor agreement (DPA, art. 28) and an impact assessment (DPIA, art. 35) are required. In the onboarding they are not a mere click: they are documents compiled with your channel’s data, which you can read and download (HTML or Markdown).
First: the data in step 1
The DPA is compiled with company name, VAT number, registered office, certified email (PEC), legal representative and DPO (name and email). While a field is missing, the card highlights it and acceptance is not possible.
Accepting the DPA
- Open the document in the card (the “I have read” box becomes active only after opening it).
- Accept: the template version and the SHA-256 fingerprint of the accepted text are recorded, with date and who accepted.
- If you later change the Controller’s data (e.g. the legal representative), the card warns you and asks to re-accept the updated document.
Filling in the DPIA
The DPIA is a questionnaire: who drafts and approves, DPO consultation, retention, proportionality, privacy notice, eight risks with likelihood and severity (the level is computed for you), twelve measures (those guaranteed by the platform are pre-ticked; the DPA measure is ticked as soon as the DPA is accepted), residual risk, outcome and review date. You can preview and then complete it: the DPIA has its own fingerprint too.