Legal Standards Framework
If you wish to establish a sound legal basis for making agreements with (cloud) providers for your institution, you can use the SURF Legal Standards Framework (Cloud)services (PDF, version September 2018). The standards framework also contains a number of important appendices that will help you use and apply the standards framework.
The main annex to the Framework of Standards is the Model Processing Agreement (pdf, version January 2019). You can use this model to draw up your own processor agreements. Because we made a number of changes to the previous version, we have made a changes document (PDF).
You can still use the old version. Please contact SCIPR for more information.
In addition to the processor agreement, the following appendices are available:
- B: Instruction (pdf): practical instruction and explanation of the provisions and appendices of the Model Processing Agreement.
- C. Safety Measures Guide (PDF, in Dutch): this document explains the so-called 'appropriate security measures', which are discussed in the Framework of Standards and the Model Processing Contract.
- D. Audit Commitment Guide (PDF, in Dutch): the Model Processing Agreement refers to an audit commitment. This document provides further explanation of this.
The Legal Committee plays an important role in drawing up the processor agreement.
In addition to the handouts, the following two documents are available:
- Model Joint Controllership Agreement (pdf)
This document is a model for parties within a joint venture, in which the various parties act as joint processing supervisors within the meaning of the AVG.
- In addition, a comparison (PDF, in Dutch)is available between the 'Generic model processing agreement 3.0 framework ibp in mbo (vocational secondary education) and the SURF Processing Agreement.
- SURF and the GDPR (in Dutch)
- Wiki' Principles of the AVG' wiki (in Dutch)
- See the 25 most common ways of processing personal data with CIA triad classification (in Dutch) (PDF)
- Acceptable Use Policy for employees (PDF, in Dutch) and for students (PDF, in Dutch)
- BIV Data Classification (in Dutch), Higher Education Reference Architecture, reference models