Data Processing
Clarify who decides the purpose of processing and who acts on whose instructions.
Fuchsius may be a controller for its own operations and a processor/service provider for client data depending on the engagement.
01Roles
- Role
- Controller
- Example
- Fuchsius decides how to use contact, recruitment or mentorship data for its own purposes.
- Role
- Processor/service provider
- Example
- Fuchsius processes client personal data only to deliver an agreed service under client instructions.
- Role
- Subprocessor
- Example
- A cloud/SaaS provider processes client data for Fuchsius where permitted.
02Data Processing Agreement
- Minimum Topics
- Subject matter and duration
- Nature and purpose
- Data types and data subjects
- Documented instructions
- Confidentiality
- Security measures
- Subprocessor conditions
- Rights/request assistance where applicable
- Breach assistance
- DPIA/regulator assistance where applicable
- Return/deletion
- Audit/information rights
- Cross-border processing
- Client D P A
- To be confirmed
03Privacy by design
- Data minimization
- Least privilege
- Purpose limitation
- Environment separation
- Secure defaults
- Retention/deletion
- Logging/monitoring
- Test-data controls
This document is a draft framework provided for review. It is not legal advice, and it must be confirmed against actual Fuchsius operations and applicable law before publication.