Reizigers

Data governanceAgreeing on how to process data

When processed and applied correctly, data offers the potential for innovative solutions. Consumers and businesses can benefit from sharing data and take advantage of the opportunities and (business) value data processing can offer. It will help to minimise waiting times and optimise cost saving in airport operations. This agreement offers a transparent framework to all those involved and prevents time-consuming legal disputes.

Why a data processing agreement?

At Schiphol we value a clear and transparent policy that details how we handle personal information. The General Data Protection Regulation (GDPR) requires a written agreement before any personal data can be shared between parties.

What is a data processing agreement?

The data processing agreement is a legal agreement that sets the terms for how personal data will be processed.

It outlines:

  • subject matter and duration of the processing;

  • nature and purpose of the processing;

  • type of personal data to be processed;

  • categories of data subjects;

  • rights and obligations of the controller.

More about sharing data

Use of Schiphol data

Create or increase your own business value with airport data

Explore our APIs

Most important subjects in the data processing agreement

  • The purpose of the processing The processor agreement makes clear what purpose the processing of the personal data has.

  • Method of processing The responsible party (not the processing party) must clearly state how the processing must take place. This prevents an external party from processing personal data in a way that has not been agreed upon by the parties involved.

  • Confidentiality The processor must keep confidential any sensitive data that it receives. The processor agreement therefore usually contains a confidentiality statement. The processing party hereby declares that it does not disclose personal information, or provide it, to others.

  • Agreements concerning possible subcontractors If an external processor outsources some of the activities to another party, clear agreements must be made.

  • Security measures All parties agree and detail which security measures are taken. This ensures that data will not be exchanged with parties outside of the agreement.

  • Duration of processing The processor agreement must provide clarity about the duration of the processing. In other words: when does the processing end and when should personal data be deleted?

Frequently asked questions about the data processing agreement