What you see here
You reach this screen from the menu under My Third Party Dossier, second item Processes others share. The page title is Processes others share.
The previous screen was about data you share. Here it is the other way round: another company shares personal data with you, for example because you keep their books, maintain their website or run their payroll. That third party is the controller and you are the processor. GDPR expects that relationship to be covered by a data processing agreement as well. Either you or the third party can initiate the paperwork.
Each card shows the process, the marker You are the processor and Received from with the company name. It carries one of these statuses:
- Not yet accepted: you have not answered this request.
- Request accepted: the agreement is in place.
- Changes requested: you asked for changes. The sender replies with a new version or a message.
- Rejected request: you declined the request.
- Stopped: the request was stopped.
If nothing has come in yet, you see No processes recorded yet. Below the list sits the block Initiate data processor agreement with the tile Register a processing activity, for data you process on behalf of a controller who has not sent a request yet.
What is expected of you
- Open a received request with Open and reply. The agreement opens with the current version on the left and, on the right, the history and Your reply. The same request also reached your privacy mailbox as an email with a link; whoever answers first, in the app or through the link, decides.
- If the agreement is correct, click Accept the agreement (or Accept version 2 and so on once there are several versions). Type your full name and role, tick I am authorised to accept this agreement for your company and confirm. Acceptance cannot be undone; the other party is told straight away and both sides keep the accepted PDF.
- If something should change, click Request changes and describe what. The other party can send you a new version, which shows the changes against the previous one: added text is underlined, removed text is struck through. You can then still accept or decline.
- If you do not agree at all, click Decline and give a short reason, so the other party knows what to change. Use Send a message for a question without a decision.
- If you work for a client who never sends a request, click Register a processing activity and describe yourself which data you process on their behalf.
- Drag to reorder and add notes on any card, just like in the other dossiers.
Next step
When every card shows Request accepted, this screen is done. The full flow is explained in How data sharing agreements work in GDPRWise. Data you share with others yourself lives on Processes we share with others. The accepted agreements are collected on the Data Sharing Agreements tab under GDPR Documents. To reread the difference between processor and controller at your own pace, see Your Third-Party Dossier: With Whom Is Data Shared?.
Watch the video
The Third-Party Dossier video shows how the two directions of the dossier fit together: watch the Third-Party Dossier video.