A data processing agreement must ensure that data processors cannot process personal data indefinitely. First, describe the purpose of the agreement. Indicate the parties involved and what the GDPR data processing agreement must obtain. “Customer” means “data controller” in this agreement, as Questback is the transformer of other companies and these other companies are customers and data controllers of Questback in the relationship. As with any contract, it is advisable to define the jurisdiction in which disputes relating to the agreement are settled (the “applicable law”). Although the GDPR applies in all EU countries (with some minor exceptions), the laws applicable to contracts can vary greatly from one country to another where the data controller and processor are established. .