Must my DPA be signed before I can use the platform?

Yes, Article 28 of the GDPR requires a contract or other binding legal act between the Controller and the Processor before any processing. A platform operating without a signed DPA is in breach, and so is its Controller customer.

Can I sign a DPA with a processor based outside the EU?

Yes, provided the transfer is framed (standard contractual clauses, adequacy decision, binding corporate rules). But EU hosting remains the simplest solution, and that is what Revydo offers.

What do I do in case of a data incident?

The Processor notifies the Controller without undue delay. The Controller assesses the risk and, within 72 hours, notifies the regulator if the risk is high. Notification to patients is only mandatory if the risk is high. The incident register must be kept current on both sides.

GDPR and reputation platforms: who is responsible for what

Data Controller and Data Processor: who does what

The Data Controller (the practice) decides the purpose of the processing (managing online reputation) and the means (which platform, what volume of reviews, what solicitation channels). The Data Processor (the platform) processes the data on the Controller's behalf, on its documented instructions, and may not use the data for its own purposes. This is the foundation of Article 28 of the GDPR.

What the DPA must contain

Subject matter and duration of the processing: what the platform does, and for how long.
Nature and purpose of the processing: Google reviews, drafts, review requests.
Categories of data: patient identification data, review content, metadata.
Categories of data subjects: practice patients who left a review or are solicited.
Processor obligations: security, confidentiality, incident notification, audit.
Sub-processors: who they are, and how the Controller is informed.
Transfers outside the EU: if any, on what legal basis (adequacy decision, standard contractual clauses).
Data subject rights: how the platform helps the Controller respond to access, rectification, erasure requests.
Data deletion at end of contract: within what delay, on what medium.

The right of audit

The Controller has the right to audit the Processor, or to have it audited by a mandated third party. The Processor must make available the information needed to demonstrate compliance. A DPA that does not provide for this right, or limits it unreasonably, is not GDPR-compliant.

Incident notification

In case of a personal data breach (leak, loss, unauthorised access), the Processor must notify the Controller without undue delay — typically within 24 to 72 hours — so the Controller meets its own 72-hour window to the regulator. The notification must include the nature of the breach, the categories and number of data subjects affected, the likely consequences, and the measures taken.

The special case of public reviews

A Google review is public content. The Controller did not invent the review, and cannot unilaterally delete it — the patient decides via Google. But the Controller remains the data controller for the personal data the review contains (name, profile photo, sometimes address), and must be able to answer an access, rectification, or objection request from the patient via the DPA.

How Revydo addresses these points

Revydo's DPA is published online, signed on request, and compliant with the model recommended by the European Data Protection Board. It lists the sub-processors (Vercel, PostgreSQL database hosted in the EU, transactional email provider), provides for the right of audit, and sets the incident notification delay at 48 hours. Data is hosted in Europe, with no transfer to a third country without an adequacy decision.