1) That the processing of personal data undertakes to process personal data only on the written instruction of the processing manager.2) Any person working with personal data is bound to confidentiality. 3) Appropriate technical and organizational measures be taken to ensure data security.4) The data processor undertakes not to outsource another subcontractor unless the processor has given the order in writing. This would mean that the same data protection obligations that the processing manager and subcontractor should agree with the subcontractor (in accordance with Article 28 of the RGPD, Sections 2 to 4).5) The processing manager is committed to assisting the processing manager in meeting his or her obligations under the RGPD, including the rights of the person concerned. 6) That the data manager agree to assist the processing manager in maintaining compliance with the RGPD with respect to section 32 of the RGPD (Data Processing Security) and Section 36 of the RGPD (consultation with the data protection authority prior to the continuation of treatments considered high risk). 7) The data processor undertakes to delete all personal data or return it to the processor after the service has ceased. 8) That the data handler should allow the processing manager to carry out a check and provide the necessary information to demonstrate compliance. While this may contain many points, not only do you have a box on the RGPD`s to-do list, but they also offer your organization and stakeholders the ability to clarify what is expected and how tasks are performed. In addition, these points also allow your organization to identify potential problems and reconsider procedures that will be more oriented towards the RGPD. Example of a Dpa, if you are a controller who enters a DPA with a processor, or you are a processor that comes into contact with a subprocessor to make sure that the specific text of your data protection authorities meets these requirements. Fortunately, the European Commission has published examples of model clauses for controllers, processors and subcontractors, to which it is possible to refer.