UK GDPR DATA PROCESSING AGREEMENT (DPA)
Schedule to Master Client & Supplier Frameworks
BETWEEN:
Romany Interpreting & Translations Ltd. (Company No: NI697290), having its registered office in Northern Ireland ("the Controller"); and
The Independent Linguist / Subcontractor and Client executing a Purchase Order or Service Assignment ("the Processor").
Details of Data Processing
Data Controller: Romany Interpreting & Translations Ltd. (or its corporate/legal/medical clients via the agency).
Data Processor: The undersigned Independent Linguist / Contractor.
Categories of Data Subjects: Clients, court claimants/defendants, medical patients, witnesses, police suspects, employees, or third parties mentioned in source materials.
Categories of Personal Data: Names, contact details, identification numbers, financial details, audio recordings, medical histories, court testimony, police records, or legal evidence contained in source materials.
Special Category Data (Sensitivity): May include racial/ethnic origin, health data, criminal convictions, religious beliefs, or biometric data provided in legal/medical settings.
Nature & Purpose of Processing: Translation, editing, transcription, and interpreting necessary to fulfil Purchase Orders issued by the Controller.
Duration: For the period necessary to complete the PO assignment plus post-project sign-off/deletion window.
1. Purpose and Scope
1.1. This Data Processing Agreement ("DPA") governs the processing of personal data by the Processor on behalf of the Controller during the performance of translation, interpreting, transcription, proofreading, and related language services ("Services").
1.2. This DPA supplements the Supplier Terms and Conditions and applies to all Purchase Orders (POs) issued by the Controller.
1.3. For the purposes of this Agreement, "Data Protection Legislation" means the UK General Data Protection Regulation (UK GDPR), the UK Data Protection Act 2018 (DPA 2018), and any relevant national privacy legislation.
2. Processor Obligations & Documented Instructions
2.1. The Processor shall process Personal Data strictly on documented written instructions from the Controller (including instructions within Purchase Orders, client glossaries, and project briefs) and for no other purpose.
2.2. If the Processor is required by applicable law to process Personal Data outside of these instructions, the Processor shall inform the Controller prior to processing, unless prohibited by law on important grounds of public interest.
2.3. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the UK Data Protection Legislation.
3. Confidentiality and Personnel Security
3.1. The Processor guarantees that all individuals authorized to process Personal Data (including employees, temporary workers, or contractors where pre-approved) have committed themselves to strict duties of confidentiality or are under an appropriate statutory obligation of confidentiality.
3.2. Access to Personal Data must be limited to those necessary for the execution of the assigned PO.
4. Technical and Organisational Security Measures
4.1. The Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including as a minimum:
Encryption: Strong encryption at rest (password-protected/encrypted drives) and in transit (SSL/TLS/encrypted email) for all electronic documents.
Physical Security: Secure work location. Remote interpreting (VRI/RSI) must be conducted in a private room free from eavesdropping or unauthorized visual inspection.
Access Control: Strong unique passwords/multi-factor authentication on all devices used to access Controller files.
Prohibition of Unauthorized AI: Public or unencrypted third-party AI tools (e.g., public ChatGPT, free web translation engines) must NOT be used to process client text or audio.
5. Sub-Processors & Subcontracting
5.1. The Processor shall not engage any sub-processor or substitute linguist to process Personal Data without the prior explicit written authorization of the Controller.
5.2. Where a sub-processor is authorized, the Processor must impose data protection obligations equivalent to those set out in this DPA via a binding written contract.
6. International Data Transfers
6.1. Where the Processor resides or operates outside the UK / EEA, the Processor agrees that Personal Data transferred from the Controller is processed in compliance with Article 46 of the UK GDPR.
6.2. The Processor shall not transfer or process Personal Data outside the UK or EEA without the prior written consent of the Controller.
7. Data Subject Rights & Regulatory Cooperation
7.1. Taking into account the nature of processing, the Processor shall assist the Controller by appropriate technical and organizational measures to enable the Controller to respond to requests from individuals exercising their Data Subject rights (e.g., Subject Access Requests, Erasure requests).
7.2. The Processor shall not respond directly to a Data Subject request unless instructed in writing by the Controller.
8. Personal Data Breach Notification
8.1. The Processor shall notify the Controller in writing within 24 hours of becoming aware of any actual, suspected, or threatened Personal Data Breach (e.g., lost laptop, email sent to wrong recipient, malware infection).
8.2. The notification must include:
Description of the nature of the breach (including categories and approximate number of data subjects/records involved).
Likely consequences of the breach.
Mitigation measures taken or proposed.
9. Return, Deletion & Audit Rights
9.1. Data Erasure: Upon completion of the project or written request, the Processor shall securely delete or return all Personal Data (including source files, draft translations, memory databases, and audio/video recordings) and delete existing copies from devices and cloud storage, unless applicable law requires storage.
9.2. Shredding: Physical notes taken during court, police, or medical interpreting sessions must be shredded immediately after the assignment.
9.3. Audit: The Processor shall make available to the Controller all information necessary to demonstrate compliance with UK GDPR Article 28 and allow for/contribute to audits or inspections conducted by the Controller or an appointed auditor.