If GÉANT, as Data controller, engage another organization as Data processor (DP) to process personal data on behalf of GÉANT, requirements defined in Article 28. of GDPR should be met and appropriate Data processing agreement (DPA) should be signed between GÉANT and DP. Process of drafting, approving and signing of DPA is shown on the following figure.

Roles and their activities

There are several roles involved in this process and each of them perform the following activities:

• Service support - WP5-T3.6 team which prepare initial draft of DPA, finalize approved version adding reference number and store it to DPA store and update Confluence wiki.
• Service owner - owner of GÉANT's service.
• DPA manager - member of GÉANT with legal background who negotiate DPA with DP and approve final version.
• Data processor - representative of DP, usually with legal background who negotiate and agree with DPA proposed by GÉANT.
• GÉANT representative - representative of the GÉANT authorized to sign the DPA.
• DP representative - representative of the DP authorized to sign the DPA.