Processor reviews
and GDPR contracts.

What is this service?

A processor review checks that every provider with access to your personal data, whether a SaaS tool, a hosting company, a call centre or a payroll bureau, is covered by a compliant contract and offers sufficient guarantees.

Under the GDPR, the controller is responsible for choosing its providers. Article 28 sets the minimum content of the contract: instructions, confidentiality, security, use of sub-processors, assistance, deletion of data at the end of the contract and audit rights.

Who is it for?

This service is for SMEs that rely on several SaaS tools and providers, and for providers themselves that need to offer a solid processing agreement to their European clients.

Situations that trigger the engagement

• You do not know exactly how many providers access your data, or in which countries.
• A European client asks for your list of sub-processors.
• You are switching CRM, payroll or hosting and need to vet the new supplier.
• You are a provider and each client sends you its own agreement to sign.

Issues we see most often

• Online terms accepted without checking the data protection clauses.
• Sub-processors (hosting, support, AI tools) never identified.
• Transfers outside the European Union not covered in the contracts.
• No security check when the provider was selected.

What the engagement includes

The review covers a list of providers agreed together, starting with those that access the most sensitive data.

Deliverables

• Provider inventory: role, data accessed, processing countries and sub-processors.
• Contract analysis: for each provider, the clauses present, missing or to renegotiate.
• Security questionnaire: a template to assess current and future providers.
• Article 28 template: an adaptable data processing agreement (DPA) in English and French.
• Action plan: addenda to request, providers to replace and points to monitor.

What you provide

The list of your providers, signed contracts and terms, and a contact in each team that uses external tools.

Typical process

Providers in Morocco: offer the agreement your clients expect

For a call centre, IT services company or payroll provider in Morocco, the processing agreement is often the first document a European client examines. A clear DPA, with an up-to-date sub-processor list and a description of security measures, speeds up signatures and cuts down the back-and-forth.

We can draft your own DPA template, so that you propose the agreement, and prepare answers to the most common security questionnaires.

Important limits

The review covers contracts and the guarantees declared by providers. It does not replace an on-site technical security audit.

RCM provides compliance and DPO support. RCM is not a law firm. When specialized legal consultation or litigation representation is necessary, it must be entrusted to an authorized professional.

Talk about your situation

Present the context, timeline and actors. We will tell you if this service really meets your needs.