Data Processing Agreement
Feature Detail
Description
The Data Processing Agreement (DPA) page provides the standard GDPR Article 28 agreement governing Norse Digital Products as data processor and each subscribing organization as data controller. Published on the Sales Website for asynchronous review during procurement, it covers processing subject-matter, duration, nature and purpose, categories of personal data and data subjects, technical and organizational security measures, sub-processor conditions, breach notification obligations, and controller audit rights.
Sources & reasoning
Explicitly listed in the Product 4 Sales Website description. The platform processes sensitive health-adjacent personal data including medical records across four regulated non-profits, making a GDPR Article 28 DPA legally mandatory. Blueprint marks all sales-legal features as MVP; phase 1 ordinal confirms MVP target release.
No source references — this artifact was included based on reasoning alone (see above).
Analysis
GDPR Article 28 mandates a written data processing agreement between any data controller and its processors. The Meander platform handles sensitive personal data including health records, medical referrals, and contact details for stroke patients, visually impaired users, and families of children with cancer, making a compliant DPA non-negotiable. Publishing the standard DPA on the Sales Website allows legal and compliance teams to evaluate it asynchronously, eliminating weeks from procurement timelines and reducing liability exposure for both Norse Digital Products and every subscribing organization.
Implemented as a static HTML page and optionally a downloadable PDF on the Sales Website. Legal content authored by qualified counsel and committed as a static asset; the PDF is served directly from the static host. The DPA must carry an effective date and version number; updates require coordinated review, legal sign-off, and a new deployment. Linked from the site footer under the legal section and cross-referenced from the Privacy Policy page. Norwegian Bokmål primary; an English version may be required for international sub-processors. No backend dependency, no database, no authentication.
Components (44)
Shared Components
These components are reused across multiple features
Service Layer (11)
Data Layer (23)
Infrastructure (7)
User Stories
No user stories have been generated for this feature yet.