Data Processing Agreements & Data Handling Agreements

Under the EU and UK GDPRs, a controller is someone who determines the purposes and means of processing personal information. China’s PIPL has the same concept, except PIPL uses the term personal information handler instead of controller.

Similarly, a processor under the EU and UK GDPRs is someone who processes personal information on behalf of a controller. China’s PIPL has the same concept, except PIPL uses the term entrusted party.

Finally, the EU and UK GDPRs define process or processing, which PIPL refers to as handle or handling, very broadly so that it covers essentially any operation performed on personal information or sets of personal information, whether or not by automated means. Processing includes, but is not limited to, collecting, recording, organizing, structuring, storing, adapting, altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning, combining, restricting, erasing or destroying personal information.

To make the remainder of this webpage easier to read, we use the EU and UK GDPR terms “controller”, “processor”, “process”, and “processing” to include their PIPL counterparts.

The EU and UK GDPRs and PIPL require controllers to take responsibility for protecting the personal information they process. This means that when controllers engage someone outside their organization to process GDPR- or PIPL-protected personal information, they must have a written agreement, referred to as a data processing agreement (GDPR) or data handling agreement (PIPL), with the processor providing explicit instructions regarding what the processor may do with the personal information and how the personal information must be secured. For those familiar with HIPAA, this requirement is similar to the HIPAA requirement for a business associate agreement.

You are likely to encounter data processing agreements (GDPR) and data handling agreements (PIPL) in the following circumstances:

If you are using an outside vendor to process GDPR- and/or PIPL-related personal information, the U of I will need to have a data processing agreement with the vendor covering any GDPR-protected personal information to be processed and a data handling agreement with the vendor covering any PIPL-protected personal information to be processed.
In the research context, if you are receiving personal information from persons or entities in the European Economic Area (EEA), the UK, or China about research subjects, you may be asked by the persons or entities providing you with the personal information to have the U of I enter into a data processing agreement (GDPR) and/or a data handling agreement (PIPL).
Vendors who process data for you may submit a data processing agreement (GDPR) and/or a data handling agreement (PIPL) to you for consideration, or incorporate it/them into their terms of service, in an effort to address the EU or UK GDPRs and/or PIPL.

Data processing agreements (GDPR) and data handing agreements (PIPL) are complex and must include specific terms required by the GDPR or PIPL. As with any contract, do not sign any data processing agreements (GDPR) or data handling agreements (PIPL) on behalf of the U of I System. Instead, forward them to the contract office you normally work with and ask that they be referred to the Office of University Counsel for review.

Your university’s contract office may also refer contracts they are reviewing to the Office of University Counsel and/or other international privacy stakeholders to assess whether a data processing agreement (GDPR) and/or a data handling agreement (PIPL) is required.

Obtaining data processing agreements (GDPR) and/or data handling agreements (PIPL) can add significant time to the contracting process. If your project or contract involves the personal information of persons physically located in the EEA, the UK, or Mainland China, be sure to build additional lead time into your efforts to allow these contract requirements to be addressed.