When sharing customers' personal data with an external service company, should a data processing agreement be signed?

ANSWER

In the described situation, a data processing agreement should be signed with each person with whom the company — as data controller — has a cooperation agreement and who runs a sole proprietorship, covering your customers' personal data (for which you act as controller). Those cooperating with you process customers' personal data on your behalf.

A template processing agreement can be found at: /wiedza/blog/wzor-umowy-powierzenia-przetwarzania-danych-zgodny-z-rodo. Alternatively, the mandatory data processing clauses from Article 28(3) GDPR may be added to your existing cooperation agreement.