ContractData Processing Agreement • April 15th, 2025
S URF Model Data Processing Agreement 4.0 STRUCTURE OF THIS DOCUMENT AND NOTES This SURF Model Data Processing Agreement can be used for all situations in which a SURF member engages a processor, i.e. for education, educational logistics, research and business operations.* When is a party a ‘processor’ as defined by the GDPR? That is the case if the SURF member: engages a third party, who, on the SURF member’s instructions and on their behalf, processes personal data, for purposes and using resources that are determined solely by the SURF member (and therefore not also by the processor), and for which the processor is allowed to determine non-essential resources (such as the hardware or software used to process the data) for the data processing activities. Please contact the Legal Affairs department or your own institution’s Privacy Office for more support, particularly for risk assessment of transfers outside the EEA. The institution may make use of the SURF Assessment Framework (