Data processing agreement
Draft reviewed 19 October 2026
1. Scope and roles
This proposed agreement covers personal data processed through Mapped Steps on the customer’s behalf, including people identified in workflows, procedure drafts, versions and contributed steps. The customer is the controller and the operator is its processor. If the customer is itself an authorised processor, the operator acts as its subprocessor and the customer must have authority to give the instructions.
Account administration, the operator’s own security administration, support and optional marketing may involve the operator acting as a separate controller. That processing must have its own lawful basis and be explained in the privacy notice; it is not brought within the customer’s instructions merely by this agreement.
The parties must identify the laws that actually apply before execution. This template uses UK GDPR Article 28 as a review baseline. Additional EU or other local requirements must be assessed where relevant.
2. Documented instructions
The operator must process customer personal data only on documented lawful instructions, including instructions about international transfers, unless applicable law requires otherwise. The final main agreement, completed schedules, customer configuration and deliberate use of agreed features will document the standard instructions. Other instructions must be recorded in a form that can be retained.
If law requires different processing, the operator must inform the customer before that processing unless the law prohibits notice on important public-interest grounds. The operator must tell the customer promptly if, in its opinion, an instruction infringes applicable data protection law and pause the affected instruction while the parties resolve it. It must not use customer content for its own unrelated purposes.
The customer must give lawful instructions, establish the required legal grounds, provide appropriate notices to affected people and limit content to the agreed scope. Each party remains responsible for its own obligations; customer instructions do not excuse an unlawful act by the operator.
3. Confidentiality and security
The operator must ensure that people authorised to process customer personal data are bound by confidentiality and receive access only as needed for their duties. It must implement and maintain appropriate technical and organisational measures, taking account of the processing, risks, state of the art and implementation costs, as applicable law requires.
The final security schedule must describe the measures actually in operation and how they are tested. Measures must address confidentiality, integrity, availability, resilience, recovery and regular assessment. Neither this template nor a statement that a vendor is used is evidence of encryption coverage, verified backups, a recovery time, a certification or a completed security audit.
4. Subprocessors
The operator must not appoint a subprocessor without the customer’s prior specific or general written authorisation. The completed schedule and agreed change process will define any general authorisation. This unsigned template does not create it.
Under general authorisation, the operator must give advance written notice of an intended addition or replacement and a meaningful opportunity to object on reasonable data protection grounds before the change. The notice period, contact channel and resolution process must be agreed before execution. If an objection cannot be resolved, the parties must agree a lawful alternative or a proportionate way to end the affected processing, including return or deletion.
The operator must bind each subprocessor to data protection obligations providing equivalent protection for the processing. It remains responsible to the customer for the subprocessor’s performance of those obligations as required by applicable law. External hosting, email or AI services do not create a blanket exemption from that responsibility.
5. Requests from individuals
Taking account of the nature of the processing, the operator must provide appropriate technical and organisational assistance so the customer can respond to people exercising their rights. It must forward a request concerning customer-controlled data promptly to the customer and must not decide the response on the customer’s behalf unless instructed or legally required.
The customer leads decisions on access, correction, deletion, restriction, objection and portability for its data. This does not prevent a person contacting the operator or a regulator, or remove the operator’s duties for data it controls itself. Verification must be proportionate and must not disclose another person’s data.
6. Personal data breaches and other assistance
The operator must notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data. It must not wait for a complete investigation before giving available information.
As information becomes available, the operator must provide the nature of the breach, affected data and people where known, likely consequences, containment and remedial measures, and a contact for follow-up. It must cooperate with the customer, preserve appropriate evidence and provide updates. A notice need not admit fault.
Taking account of the processing and information available, the operator must assist the customer with security obligations, breach assessments and notifications, data protection impact assessments and prior consultation with a regulator. The customer leads its regulatory and affected-person notifications unless law requires the operator to act directly. The processor’s duty to notify the customer without undue delay is separate from any applicable controller deadline for notifying a regulator.
7. Evidence, audits and inspections
The operator must make available the information needed to demonstrate compliance with its processor obligations and allow for and contribute to audits and inspections by the customer or its appointed auditor.
The parties may agree reasonable notice, confidentiality, security and scope arrangements that protect other customers and avoid unnecessary disruption. Existing independent evidence may help an audit, but cannot automatically replace a legally required inspection. Such arrangements must not prevent required oversight, regulator access or a timely response to a substantiated incident.
8. Return, deletion and retention
At the end of the relevant service, the operator must, at the customer’s choice, return or delete the customer personal data and delete existing copies unless applicable law requires retention. The final schedule must define usable export formats, the instruction process, deletion timing, backup cycles and confirmation of completion. These operational periods have not yet been agreed or verified.
Where immediate removal from a backup is not technically possible, retained copies must be protected, put beyond ordinary use, excluded from further processing except necessary recovery or legal requirements, and removed on an agreed, justified deletion cycle. If a backup is restored, previously required deletions must be reapplied. Any legally required retention must be limited to the relevant data and purpose, with notice where lawful.
Revoking a contribution link prevents further permitted submissions; it does not itself delete earlier submissions, placed steps or version copies. Deleting browser storage does not delete server data. The final retention schedule must cover these copies separately rather than promising that one action erases everything.
9. International transfers
The operator must not make a restricted transfer outside an applicable protected territory without lawful instructions and a valid transfer mechanism. The parties must verify whether adequacy, appropriate contractual safeguards or another lawful route applies to each actual transfer, including relevant remote access, and complete any required assessment and supplementary measures.
This template does not itself execute an international data transfer agreement, EU standard contractual clauses or the UK Addendum. The correct parties, modules, completed annexes and assessments must be put in place where needed. An unfilled vendor region or a link to a vendor policy is not a transfer safeguard.
10. Responsibility and precedence
Each party retains its direct duties under applicable data protection law. No provision restricts individuals’ statutory claims, supervisory authority powers or mandatory rights and remedies. No numerical liability cap has been agreed or applies through this draft. Any final contractual allocation must be lawful, appropriate to the risk and consistent with mandatory processor and subprocessor duties.
In a final executed agreement, applicable mandatory transfer clauses must take precedence where required, and this data processing agreement must take precedence over conflicting general service terms for customer personal-data processing. Governing law and dispute arrangements remain to be finalised; none are selected here.
Schedule A. Processing to be agreed
Subject matter and purpose: hosting, storing, displaying, editing, sequencing, versioning and exporting customer workflow and procedure content; receiving steps through customer-created contribution requests; optional AI drafting only when instructed and permitted by the final provider review.
Duration: the agreed service period plus the completed return/deletion period. Actual periods and any legal-retention exceptions are unfilled.
People: workspace owners, admins, editors, viewers, invited colleagues, guest contributors and other people the customer lawfully identifies in process content.
Ordinary data: work names or roles, business contact information where needed, contribution names, process responsibilities, actions, systems, submitted free text and associated document/version metadata. The customer must describe any other categories before processing begins.
Excluded standard use: passwords, access keys, payment-card details, identity documents, health or other special-category data, criminal-offence data and information about children. A prohibition is not a technical filter; the parties still need a process to identify and handle unintended submissions.
Customer instructions and rights: configure the agreed features, decide content and recipients, request lawful changes, obtain required assistance, and choose return or deletion at the end. The authorised instruction contacts and change process are unfilled.
Schedule B. Vendor and transfer review
The product names below describe the proposed architecture, not verified contracting entities or an approved subprocessor register. Confirm the legal entity, specific product, data accessed, region, support access, contractual protections, transfer route, retention and deletion terms for each before execution.
- Cloudflare: application hosting and request delivery, security services, D1 email/export records and abuse controls, and optional Workers AI drafting. Contracting entity, enabled products, processing locations and transfer safeguards: not confirmed.
- Supabase: sign-in infrastructure, account profiles, cloud documents, saved versions and contributed steps. Contracting entity, project region, relevant access locations and transfer safeguards: not confirmed.
- Resend: verification and workflow-export email delivery, including exported content when the customer requests it. Contracting entity, processing locations, retention and transfer safeguards: not confirmed.
Microsoft, Google or Apple may separately process sign-in information under their own terms. Their legal roles and any relevant service-provider arrangements must be mapped during the identity-provider review; they are not assumed to be customer-content subprocessors by this list.
Still to complete: approved vendor schedule, notification channel and advance-notice period, objection handling, locations, applicable transfer instruments and assessments. No all-UK or all-EU storage promise is made.
Schedule C. Security and retention to verify
Record evidence and accountable owners for access control and tenant isolation; privileged access and authentication; secret management; transmission and storage protection; secure development and vulnerability handling; incident response; logging limits; backups and tested restoration; deletion and legal holds; vendor review; and periodic effectiveness checks.
Complete the actual retention and deletion periods for active and closed documents, saved versions, unplaced and placed contributions, revoked or expired requests, local recovery copies, logs and backups. Record separate controller retention for account, support, marketing and verified-email records. Set out how erasure is reapplied after a restore and how completion is confirmed. None of these operational commitments is certified by this draft.
Execution checklist
Complete both parties’ legal identity and contacts, lawful customer instructions, applicable laws, all schedules, the security evidence, the main agreement and authorised acceptance before using this as a customer contract. Obtain jurisdiction-specific legal review. A privacy notice alone is not an Article 28 processing contract.
Review sources
Official UK review references: ICO processor contract requirements, processor responsibilities, breach guidance and international-transfer guidance. ICO flags some guidance for review following the Data (Use and Access) Act; the final contract must reflect applicable law when agreed.