Services
Contracts & Suppliers
We draft and review the agreements that govern personal data moving between you and your customers and suppliers: data processing agreements, checks on a supplier before it gets access to your data, and transfers of data out of Israel. You can then answer a customer’s questionnaire and work with suppliers without a gap between the contract and reality.
When this usually surfaces
The need for these agreements usually shows up at one of these five moments.
| # | The event | What breaks |
|---|---|---|
| 1 | A customer sends a security and privacy questionnaire | No documents are ready, and the answers are written in a hurry |
| 2 | A European customer | A GDPR addendum, a mapping exercise, and whether you need a representative in the EU |
| 3 | A regulated body updates its security annex | What exactly you undertook, and what happens when the requirements tighten |
| 4 | A new supplier asks for access to your data | What it will see, where the data will be kept, and what the contract says before you start |
| 5 | A cloud system outside Israel | What allows you to transfer the data to it, and where that is recorded |
What gets examined
The review covers four areas, from your agreements with customers to your own suppliers.
Your DPAs against reality
Whether your customer DPAs describe what you actually do.Your suppliers
Your DPAs with the suppliers that hold data for you, and the risk review the Data Security Regulations require before you engage them.Transfers out of Israel
Where the data is actually stored and processed, and on what basis it may be transferred.Customer audits
What you will need to produce when a customer or a regulated body audits you.
Deliverables
At the end you receive agreements and records you can sign and work by.
| Deliverable | What it contains |
|---|---|
| Data processing agreements | Drafting and negotiation of DPAs with customers and suppliers, in Hebrew and English, including a European customer’s requirements. |
| Supplier addendum | A confidentiality and security addendum for your suppliers, with everything the Data Security Regulations require in the contract. |
| Supplier register | For each supplier: what data it receives, where the data sits, which processing terms apply, and when it is checked again. |
| Transfers abroad | The basis for each transfer out of Israel, the recipient’s written undertaking, and the transfer’s entry in the database definitions document. |
How it runs
The work runs in five steps, and the scope is set in writing before it starts.
- Initial fit call
- A first discussion of the need, scope and priorities.
- Scope letter
- Deliverables, timetable and terms of engagement, in writing, before work starts.
- Collection
- A questionnaire and documents, then two to three conversations with the relevant people on your side.
- Delivery
- The deliverables, then a handover session on the gaps and the order to address them.
- Continuation, if you want it
- Ongoing support or filling the officer role.
- 1. Fit call
- 2. Scope letter
- 3. Collection
- 4. Delivery
- 5. Continuation
Questions people ask
Does every supplier with access to our data need a contract?
As a rule, yes. The Data Security Regulations require a risk review before you engage the supplier, and a contract that sets out, among other things, what data the supplier processes and for what purpose, the conditions for using sub-processors, incident reporting, and returning the data at the end. The duty applies at every security level, even when the supplier only accesses the data and does not store it. An engagement with a self-employed individual is not subject to it, but that too is worth putting in a contract.
Is our cloud provider's ISO 27001 certification enough?
No. The standard covers security. A transfer out of Israel needs its own basis and a written undertaking from the recipient, and the transfer is recorded in the database definitions document. In most cases the transfer is allowed, and what is missing is the record.