Data processing agreements in Poland: when is a DPA required and what should it cover?
A data processing agreement is required where a supplier processes personal data on a controller’s behalf. A standard DPA is not enough: the parties must first identify their real roles and then document the service, security, sub-processors and exit arrangements.