§ Data Agreement (DA) Specification
-Specification Status: version 2.1.0
-Released and implemented.
+Specification Status: +version 2.1.0 (Released and implemented)
Latest Draft: Avaialble here
Editors:
-
@@ -68,9 +68,10 @@
- File a bug
GitHub repo
§ Abstract
A Data Agreement records the conditions for an organization to process personal data in accordance with privacy regulation (e.g. GDPR) captured in a signed receipt given to the individual. To automate creation of the record and increase the trust assurance a Data Protection Impact Assessment may be used to populate the record.
-§ Introduction
+§ Introduction
This specification describes how a Data Agreement between an organisation and individual is managed in order to capture, in a receipt, the conditions of processing of personal data. The receipt acts as evidence and demonstrates a higher level of accountability and is based on standard schemas. The accountability is further enhanced by directly integrating the Data Agreement with the input from a risk assessment, e.g. Data Protection Impact Assessment.
In order to create the Data Agreement, and the resulting receipt as proof, a number of steps are required from different actors. This document describes these steps involved and is described as part of a Data Agreement lifecycle.
§ Abbreviations
@@ -392,11 +393,11 @@§ Terminati
§ Proof
In accordance with GDPR Art. 30, Records of processing activities, a Data Controller (Data Source and DUS) shall record processing activities under its responsibilities. The records shall be available to the individual to inspect in the form of a receipt and provide means of an audit. An audit can be initiated due to the following reasons:
-
-
- Complaint by Data Subject +
- Complaint by Data Subject (Or Individual)
- Review of Data Source or Data Using Service record logs
The complaint by Data Subject will include a copy of the Data Agreement receipt and explanation of the violation by Data Source or DUS.
-The following sequence is the approach taken when the auditor reviews implementation of Data Agreement capture and withdrawal. If the auditor lacks the software to perform the read then a dashboard access is provided by the Data Source or DUS. In case of a Data Subject complaint a reference to the original Data Agreement is shared with the Auditor so the Auditor can perform the same verification.
+The complaint by Data Subject (Or Individual) will include a copy of the Data Agreement receipt and explanation of the violation by Data Source or DUS.
+The following sequence is the approach taken when the auditor reviews implementation of Data Agreement capture and withdrawal. If the auditor lacks the software to perform the read then a dashboard access is provided by the Data Source or DUS. In case of a Data Subject complaint, a reference to the original Data Agreement is shared with the Auditor so the Auditor can perform the same verification.
§ References
[1] Data Agreement Interface Specification
@@ -1222,6 +1223,7 @@