Data Processing Agreement

1. Subject matter, duration, nature and purpose

• Subject matter: hosting and processing of the Controller's regulatory documentation and related records in the Service.
• Duration: the term of the agreement, plus the export and deletion period described below.
• Nature and purpose: storage, indexing, retrieval, AI-assisted drafting, review, approval, export and audit logging of documentation, as instructed by the Controller through the Service.

2. Categories of data subjects and personal data

• Data subjects: the Controller's employees and contractors who use the Service; persons named in the Controller's documentation (for example authors, reviewers, signatories, the person responsible for regulatory compliance, authorised representatives and Notified Body contacts).
• Personal data: names, business contact details, roles and signatures; identifiers and IP addresses in the audit trail; content of documents to the extent it contains personal data.
• Special categories of personal data are not intended for the Service. The Controller must not upload patient-level health data unless a separate written agreement covers it.

3. Controller instructions

The Processor processes personal data only on the Controller's documented instructions, which are the agreement, this DPA and the Controller's use of the Service, unless required to do otherwise by EU or Member State law, in which case the Processor informs the Controller before processing unless the law prohibits it. The Processor informs the Controller if it considers an instruction to infringe data protection law.

4. Processor obligations

• Confidentiality: persons authorised to process personal data are bound by confidentiality.
• Security: the Processor implements the technical and organisational measures in the Annex and keeps them current.
• Assistance: the Processor assists the Controller, taking into account the nature of the processing, in responding to data subject requests and in meeting the Controller's obligations on security, breach notification, data protection impact assessments and prior consultation.
• Breach notification: the Processor notifies the Controller without undue delay, and in any case within [48] hours, after becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs to meet its own obligations.
• Deletion or return: at the end of the Service the Processor returns the Controller's data on request and deletes remaining copies within [30] days, except where EU or Member State law requires storage. The immutable audit trail is exported to the Controller as part of the return.
• Audits: the Processor makes available the information necessary to demonstrate compliance and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, on reasonable notice and no more than once a year unless a breach or a supervisory authority requires otherwise.

5. Sub-processors

The Controller gives general authorisation to the sub-processors listed below. The Processor informs the Controller of intended additions or replacements at least [30] days in advance, giving the Controller the opportunity to object on reasonable data-protection grounds.

• Google Cloud EMEA Ltd (Ireland): hosting, databases, storage, secrets, monitoring and AI model access; data location EU, Frankfurt (europe-west3).
• Neo4j, Inc. (AuraDB): hosting of the regulatory knowledge graph used for retrieval [confirm region and data scope].
• [Any email, support or notification provider to be listed here.]

6. International transfers

Processing takes place in the EU. Any transfer to a third country is subject to Chapter V GDPR, using the European Commission's Standard Contractual Clauses (module two, controller to processor, or module three for sub-processors) or an adequacy decision, together with supplementary measures where required.

7. Liability and precedence

Liability under this DPA is governed by the liability provisions of the agreement. In the event of conflict between this DPA and the agreement on data-protection matters, this DPA prevails.

8. Annex: technical and organisational measures

• Tenant isolation enforced in the database by row-level security on every tenant-scoped table, including for the table owner; evidence-vector access refuses privileged roles that could bypass it.
• Encryption in transit (TLS) and at rest (provider-managed keys) for databases, storage and backups.
• Role-based access control with default-deny permissions, enforced at the API, query and database layers; signature actions require password re-authentication and record the signatory's role at signing time.
• Append-only, timestamped audit trail of regulated actions and of permission denials; audit failures are never silently discarded.
• Secrets held in a managed secret store; no credentials in source code or build images.
• Automated daily backups retained for 30 days with point-in-time recovery; restore procedure documented and [tested on date].
• Monitoring and alerting of server errors, failed schema migrations and failed background jobs to the operator; security-relevant configuration verified after each deployment.
• Change control: every release passes an automated quality gate; production migrations are recorded with the deployed version.
• Personnel: named operators only; confidentiality obligations; least-privilege cloud IAM.