Data processing agreements
Set out the processing's subject matter, duration, nature and purpose, alongside each party's responsibilities and security requirements.
Data protection documents | Cork and Ireland
GDPR documents for Irish organisations
Most GDPR gaps appear where personal data changes hands. Davitts Solicitors prepares the agreements, notices and working records that explain who handles the data, for what purpose and on whose instructions.
Start with the hand-off.
Based on Carrigrohane Road, Cork. Consultations are available remotely across Ireland.
A practical document set
The core data protection documents we prepare
Each document has a job. The set should agree across supplier contracts, privacy information and internal records.
Data protection addenda
Attach data handling terms to an existing supplier or customer contract while leaving the agreed commercial terms in place.
Privacy notices and policies
Explain data use to website visitors, customers, employees and applicants in language people can follow.
Confidentiality terms
Prepare terms for staff, contractors and advisers, aligned with the relevant processing documents rather than repeating them inconsistently.
Internal records and decision notes
Keep processing inventories, supplier registers and review notes in a format your team can update and use.
Keep the set aligned.
Start with the task in front of you
Which document do you need right now?
The right starting point depends on who is handling the information and what they have asked you to put in writing.
Supplier chains and contract wording
Processor, sub-processor and international transfer wording
A service can involve several organisations and more than one hosting region. The paperwork needs to show who does what, and how changes are handled.
Controller instructions
Record the controller's instructions and the processor's commitments, including the scope of the service, security measures and assistance with requests.
Sub-processor controls
Set out authorisation, notice and objection steps in terms that match how your client and vendor teams actually manage supplier changes.
Transfers and service changes
Review transfer provisions and supplementary measures where infrastructure sits outside the EEA. Keep the wording current as vendors, hosting regions and integrations change.
Roles must be clear.
Plain-English privacy information
Privacy notices audiences actually read
One notice rarely explains every relationship well. Choose an audience to see the issues its document should address.
Website visitors
Explain what the site collects through forms, analytics and other tools, why that information is used, and which providers may receive it. The notice should match the tools currently installed.
Check cookie and analytics references when the website changes.
Customers
Describe how customer contact, account and transaction information is used, how long it is kept and when suppliers support delivery of the service.
Keep the notice consistent with customer terms and processing agreements.
Employees
Set out the workplace information the organisation uses, its purposes, retention approach and the types of service providers involved in HR and payroll.
Review it when HR systems or staff processes change.
Job applicants
Explain how application details, interview notes and references are handled, who may see them and how long unsuccessful applications are retained.
Keep the wording distinct from the employee notice.
One audience at a time.
Working documents for real events
Breach documentation and the records you will be asked for
A clear record helps your team assess an incident, coordinate notifications and answer a later supplier or client review.
What good looks like
A consistent incident record
Capture when the issue was identified, what information may be involved, who assessed the facts and which decisions followed. Keep the record usable during a live response.
Notification steps that match the contract
Set out internal escalation and processor-to-controller notification expectations. The timing language should match the relevant agreement and the organisation's response process.
Records people can maintain
Use processing inventories and supplier registers that identify the service, information involved, vendor and relevant agreement. Keep the format practical for routine updates.
A review rhythm with a clear owner
Set a regular check for changes to services, suppliers, hosting locations and retention periods. Name who updates the records when a change occurs.
Keep working records.
Documents shaped around the work
Where these documents matter most in practice
The same data protection questions show up differently across services. The documents should reflect the service being delivered.
Technology and SaaS
- Customer and vendor processing agreements
- Sub-processor lists and security schedules
- Hosting and service-change wording
Healthcare and care services
- Information handling documents for service users
- Confidentiality terms for relevant personnel
- Supplier and processing records
Recruitment and HR
- Candidate and applicant privacy notices
- Client terms for recruitment services
- Placement-related processing clauses
Accountancy and professional services
- Engagement letters with data handling terms
- Client confidentiality wording
- Processing agreements for supporting providers
The details differ.
Talk through your documents
Request a document review
Tell us what has changed or what a client has requested. We can help identify the documents to prepare or update.
+353 82 274 8712 [email protected] Request a consultationA useful place to begin
Ask which data protection documents you actually need
Bring the details you have. A clear starting point helps us focus the discussion.
It helps to know:
- What personal data your organisation holds
- Which suppliers handle it and where the service is hosted
- What a customer, supplier or reviewer has asked you to provide
Carrigrohane Road, Cork, Ireland. Remote consultations are available across Ireland.
Please keep enquiry details relevant to your request. Read our privacy policy for information about how enquiries are handled.
Bring the request.