Data processing agreements for sales tools

Start with the roles, because everything else follows from them. The Swedish data protection authority IMY defines the controller as the party that decides why the data is processed and how, and the processor as the party that processes personal data on the controller's behalf. Your company is the controller for prospect and customer data. The CRM vendor, the dialer vendor and the AI tool are processors. IMY's guidance leaves no room for doubt: when a processor handles personal data for a controller, the processing must be governed by a contract, and that contract must be in writing and binding on both parties. Small teams get no exemption, and neither do tools that 'only' store email addresses. We have covered how the roles split for AI meeting assistants in particular before; this time the content of the agreement is the backbone. This is an editorial walkthrough, not legal advice.

Two situations, two agreements

According to IMY, the GDPR describes two situations that call for a processing agreement. The first is between you as controller and the vendor as processor, under Article 28(3). The second is between the vendor and its sub-processors, under Article 28(4), for example the cloud provider hosting the CRM database. You sign only the first agreement, but that first agreement has to give you control over the second: before a sub-processor can be engaged, the processor must first obtain your written permission. In practice this is handled with a list of approved sub-processors in the agreement and a right to object when the list changes. That list is also the first place to look when the question of storage in the United States comes up.

The checklist: the eight minimum terms of Article 28(3)

IMY lists eight minimum requirements for the content. Here is each one, with what to look for in a sales tool in particular.

1. Processing only on documented instructions. The vendor may not use your customer data for its own ends, such as training an AI model or building its own contact database. If the contract says the vendor may 'improve the service' with your data, ask what that actually means.
2. Confidentiality, or a statutory duty of secrecy, for everyone who touches the data, the vendor's consultants and support staff included.
3. Appropriate security measures under Article 32: encryption, access control, logging. The vendor's security annex should be specific, not a vague promise of 'industry standard'.
4. Conditions for sub-processors: a list, a requirement for written approval and a right to object to new ones.
5. An obligation to help you honour data subjects' rights: that you can export, correct and delete an individual contact within the month the law allows you.
6. Assistance with your obligations under Articles 32 to 36: the vendor must report personal data breaches to you without undue delay, so that you in turn can notify IMY within 72 hours.
7. What happens to the data when the contract ends: deletion or return, in which format and within what timeframe. Ask how you get the entire customer database out on the day you switch systems.
8. The right to audit and inspect, which in practice often means the vendor's audit reports, but the right itself must be written into the contract.

Beyond those eight points, the agreement has to describe the subject matter and duration of the processing, its nature and purpose, the types of personal data and categories of data subjects, and the controller's rights and obligations. The parties are free to add further terms, and IMY notes that instructions can be given in writing by other means, email for instance, provided they can be saved and therefore documented. The email in which you ask the vendor to switch off a feature is an instruction; keep it.

Four questions that expose a weak agreement

• Who decides the purpose? If the vendor itself decides what the customer data may be used for, it is a controller rather than a processor, and according to IMY a processor that acts outside its instructions can be held liable as a controller. An agreement that leaves this open protects nobody.
• Where are the sub-processors? An agreement with no list, or one that says only 'cloud providers', gives you no way of assessing storage outside the EU.
• What happens to the data when we cancel? An agreement that says nothing about deletion and export leaves your customer data sitting with a vendor you no longer pay.
• How quickly do we hear about a breach? 'Without undue delay' is the law's wording; an agreement promising notice 'within a reasonable time' does not protect your 72-hour window.

The standard clauses, and what they do not solve

On 4 June 2021 the European Commission published two sets of standard contractual clauses: one for transfers to countries outside the EU and EEA, and one for the relationship between controller and processor. The second set can be used as a processing agreement as it stands, and plenty of vendors do exactly that. Do not confuse the two: the clauses for processing agreements do nothing to settle the question of storage in the United States, which needs the first set or an adequacy decision. And no set of clauses settles the parts that are yours: the purpose, the instructions, the retention period and control over who on your own team may read the data. The EDPB's Guidelines 07/2020 on the concepts of controller and processor, in their final version from July 2021, are the best reading for anyone who wants to understand where the line between the roles falls.

What is at stake

IMY's maximum administrative fines run to 20 million euros or four percent of global annual turnover for the most serious infringements, and 10 million euros or two percent for the somewhat less serious ones, whichever amount is higher. There is no fixed sum for any given infringement. The practical problem is a different one: without a processing agreement, nothing on paper shows that the processing at the vendor happens on your terms, and the day a customer asks to see their data or a breach hits the vendor, you have no contractual right to help in time.

If you are the one selling the tool

The same checklist works in reverse. If you sell a system that stores your customer's personal data, their lawyer will ask for a processing agreement, and the deal goes nowhere until one exists. Have it ready before the negotiation starts: the sub-processor list, the security annex, the breach routine, the export format on termination. A rep who can answer the four questions above in the meeting, rather than referring everything to legal, cuts weeks off that part of the sales cycle.

Ask the same questions of your practice tool

An AI tool for sales training is a processor too if it handles personal data, so run the checklist on it as well. In Salesprep you need no real customer data to practise: the counterparts are fictional, the raw audio from calls is deleted straight after scoring, transcripts and scores live in your own history, and all data can be deleted whenever you like. The Cold call module is included in every plan with three free calls; Follow-up and Reschedule are available on Pro and up, and all six modules on Team Pro.