Data processing addendum.

Last updated 6 September 2026

Every retainer, Foundation and fixed-price project is covered by a data processing addendum under Article 28 GDPR, signed before any admin account is granted. Request the current version by email: sean@seanjohns.com. It goes out the same day, with the statement of work.

What it covers

• Roles. You are the controller. Sean Johns ([LEGAL ENTITY AND VAT]) is the processor, acting only on your documented instructions.
• Scope. Access to your identity provider, device management, ticketing, SaaS spend exports and related admin consoles, for the purposes and duration set out in the statement of work.
• Named access and logging. One named admin account, with multi-factor authentication, whose actions are logged and summarised in the monthly report.
• Confidentiality. A confidentiality obligation that survives the engagement; no use of your data for any other client or purpose.
• Sub-processors. None by default. Any tool that would touch your data is named in writing beforehand, and you can object.
• Security measures. Encrypted managed devices, least-privilege access, no local copies of exports beyond the engagement, and prompt revocation of access at handover.
• Breach notification. Without undue delay and within 24 hours of becoming aware, with what is known at the time.
• Assistance. Help with your own obligations: data-subject requests, impact assessments and audits, at no extra cost where the request is reasonable.
• Return and deletion. At the end of the engagement, all data returned or deleted at your choice, confirmed in writing.
• International transfers. Work is performed from Spain. No transfer outside the EEA/UK without your written agreement and an appropriate safeguard.
• Insurance. Professional indemnity and cyber insurance in place; certificates available on request.

UK engagements

The same addendum is issued under UK GDPR and the Data Protection Act 2018, with the ICO as supervisory authority and the UK International Data Transfer Addendum where relevant.

Your paper or mine

If your company has its own DPA template, send it. It is usually faster to sign yours than to negotiate mine.