Effective date: [EFFECTIVE DATE] · Issued by [LEGAL ENTITY NAME]
This Data Processing Agreement (“DPA”) forms part of the agreement between [LEGAL ENTITY NAME] (“Processor”) and the business customer (“Controller”) where the Processor handles personal data on the Controller’s behalf through AI Command.
This DPA does not govern the Processor’s separate controller processing for billing, business contact administration and its own compliance.
The Processor will process customer personal data only on documented instructions, including instructions in the agreement and authorised product configuration, unless required otherwise by applicable UK law; where legally permitted it will inform the Controller before processing required by law.
The Processor will promptly inform the Controller if, in its opinion, an instruction infringes applicable data protection law.
Persons authorised to process personal data will be bound by confidentiality obligations.
The Processor will implement appropriate technical and organisational measures under UK GDPR Article 32, taking into account the nature of processing and risk. Complete a separate verified security schedule before signature.
The Controller grants general written authorisation for subprocessors listed in the published subprocessor register, subject to appropriate contractual protections. The Processor will notify the Controller of intended additions or replacements and provide a reasonable opportunity to object on data-protection grounds.
The Processor remains responsible for the performance of its subprocessors’ data-protection obligations to the extent required by law.
Taking account of the nature of processing, the Processor will assist the Controller with requests to exercise data-subject rights, and with security, breach notification, impact assessments and prior consultations where required by UK GDPR Articles 32–36.
The Processor will forward requests received directly that relate to customer-controlled data unless legally prohibited.
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting customer data and provide information reasonably available to support the Controller’s obligations.
Complete incident reporting contact and agreed notification service levels: [INCIDENT REPORTING EMAIL].
The Processor will not make restricted transfers of customer personal data without a lawful mechanism and appropriate safeguards. Complete the verified transfer locations and mechanism schedule before signature.
At the Controller’s choice, the Processor will delete or return personal data following termination, and delete existing copies unless retention is required by law, subject to agreed technical backup handling and documented timeframes.
The Processor will make available information necessary to demonstrate compliance with Article 28 and allow for and contribute to reasonable audits and inspections by the Controller or its mandated auditor, subject to proportionate confidentiality and security procedures.
Subject matter: providing a Microsoft 365 licence, security-readiness and adoption intelligence service. Duration: the service term and agreed deletion period.
Nature and purpose: synchronising authorised tenant metadata, matching users to licence products, calculating estimated optimisation opportunities, generating reports and securing the service.
Data subjects: customer staff, contractors, administrators and other tenant users. Data categories: names, work email addresses, Microsoft user and tenant identifiers, licence assignments, subscription details, relevant adoption metrics, audit records and configuration metadata.
Sensitive categories: not intended for the core licence-optimisation feature; review separately if future modules introduce them.
Security measures: [INSERT VERIFIED ACCESS CONTROLS, ENCRYPTION, LOGGING, BACKUP, INCIDENT AND RESTORATION DETAILS].
Retention/deletion: [INSERT VERIFIED RETENTION PERIODS]. Hosting and transfers: [INSERT ACTUAL HOSTING REGIONS].
Subprocessors: see the published register, which must be verified and completed before this DPA is relied upon.
Important: this is a contractual draft. Have UK counsel review the agreement, schedules, objection process, liability allocation and international transfer mechanism before execution.