Legal
Data Processing Agreement
Where KROG processes personal data on a client's behalf, the engagement is governed by a Data Processing Agreement aligned with Art. 28 GDPR. KROG maintains a Data Processing Specification (ISO 27560) and consent receipts (ISO 29184) as the auditable record.
Pending final review The full DPA — sub-processor list, technical and organisational measures, transfer impact assessment and audit rights — will be published in this section once reviewed.