A framework for documenting processing responsibilities when InitLabel processes personal data on behalf of a customer.
The customer determines the documented purpose and instructions for processing. InitLabel processes data only as required to perform the agreed services, subject to the contract.
Personnel with access to customer data should be subject to appropriate confidentiality obligations.
The parties should document technical and organizational measures appropriate to the nature and risk of the data and processing activity.
Where subprocessors are used, applicable contractual requirements should address authorization, confidentiality, security, and accountability.
The parties should cooperate on applicable data subject requests and documented incident-response procedures.
