Key takeaways
- As controller you hold the responsibility. A provider can give you documentation and assistance, but it cannot take over your duties.
- Require a data processing agreement, a list of sub-processors and clear answers on where data is processed.
- Ask about retention and deletion of message content and logs, access control, incidents and audits.
- Keep the agreement, the answers and your assessment, so you can document your choices to the Danish Data Protection Agency.
- This is general information and not legal advice.
Can a provider promise full compliance with GDPR?
No. As the controller you decide why and how recipients’ data is used, and the responsibility cannot be handed to a provider. The provider is normally a processor and handles the data on your behalf, on your instructions. A provider can document how it protects data and help you meet your obligations. It cannot promise that your use is lawful.
In general terms, Datatilsynet, the Danish Data Protection Agency, expects a controller to choose a processor that can document adequate security, to have a written agreement and give clear instructions, to supervise to a degree that matches the risk, and to be able to show what it has done. How much supervision is enough depends on how extensive and sensitive the data is. This is general information and not legal advice.
What should a data processing agreement contain?
GDPR requires a written agreement when a provider processes personal data for you. Read it, and check that it at least covers the points below. For some purposes, such as invoicing and abuse prevention, the provider can be a controller itself, so get that described clearly in the agreement.
- What the provider may do: the purposes, the types of data (phone numbers, message content, logs) and that it follows only your instructions
- Sub-processors: who they are, and how you are told about changes and can object
- Security measures: what the provider does to protect data, and that staff are bound by confidentiality
- Help with your obligations: for example requests from data subjects and notification of breaches
- Deletion or return of data when the agreement ends
- Documentation and audit: that you can obtain information and have checks carried out
How do you assess sub-processors and transfers?
A messaging provider typically uses several links: its own hosting, upstream providers, operators and tools for support and monitoring. Ask for a list of sub-processors with their country and purpose, and for how you are told before it changes.
If the provider or a sub-processor transfers data to a country outside the EU/EEA, there must be a valid transfer basis, for example an adequacy decision or the European Commission’s standard contractual clauses. Remote access from a third country, for example for support, can also count as a transfer. For international messages, the phone number and content necessarily pass through networks in the recipient’s country, so “no data leaves the EU” is seldom possible for all traffic.
- Which countries process and store message content, logs and account data
- Which transfer basis is used for each country outside the EU/EEA
- Who at the provider and the sub-processors can access data, and from which countries
What should you ask about retention, access and incidents?
| Area | What you should get answers to |
|---|---|
| Retention and deletion | How long message content and delivery logs are kept, whether content can be left out or masked, how data is deleted on request and at the end of the agreement, and what happens to backups |
| Access and logging | Who can see message content, whether access is role-based, how API keys and user accounts are protected, and whether access and changes are logged |
| Incidents | How quickly you are told of a breach, what the notice contains and whom you contact. As controller you generally have to report a breach that poses a risk to Datatilsynet within 72 hours of becoming aware of it |
| Audit and documentation | Which audit reports, certifications, penetration test summaries or security descriptions the provider can show, and whether you can have checks carried out or take part |
How do you document the assessment, also as a public customer?
Keep the data processing agreement, the provider’s answers, the list of sub-processors and your own risk assessment with a date, and repeat the assessment when the agreement or the provider’s setup changes. Do not send sensitive information in the message text itself; SMS is not end-to-end encrypted, so use a link or a code.
Public authorities often have further requirements from tender documents and their own information security policies. Put the questions in writing, require written answers, and ask for documentation of the requirements that are decisive for you, for example certifications or requirements on where data is located.
How ZafeConnect fits
ZafeConnect is a Danish company (ZafeConnect ApS) and operates under the GDPR. The security page and the privacy policy describe what ZafeConnect states; ask for the data processing agreement. Hosting and data location, sub-processors and any certifications are not published on the site, so ask for them in writing in a security review. Whether ZafeConnect meets your requirements is for you to decide from the answers.