Does a network monitoring service need a data processing agreement?
Yes, if the provider processes personal data on your behalf, and network monitoring nearly always does. IP addresses, device names, user names in hostnames and connection times can identify a person directly or indirectly, so they count as personal data under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679).. When a vendor processes them for you, you are the controller and the vendor is the processor, and the GDPR requires a contract or other legal act that sets out the subject matter, duration, nature and purpose of the processing, the types of data, your instructions, security, sub-processors, assistance with breaches and what happens at the end. Read it like any other contract: check breach notification times, audit rights, sub-processor notice and deletion at the end. NetSenX’s data processing agreement is published on its website and forms part of the terms of service, so it applies from the moment you use the service; Enterprise customers who need a signed copy can request one.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Is the NetSenX data processing agreement public, and what does it commit to?
- Where does NetSenX store data about our employees’ devices, and for how long?
- Do we need a data protection impact assessment before deploying network monitoring?
- Is a smaller European security vendor a business continuity risk?
- What is the US CLOUD Act, and does it affect data stored in the EU?
Terms used here
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).