Short answer:A PUB agreement is a written agreement between you (personal data controller) and a supplier (personal data assistant) who processes personal data for you. You must have one as soon as an external party processes personal data on your behalf – it is a requirement in the GDPR, not a voluntary one.
What is a PUB agreement?
PUB stands for personal data assistant. A personal data processor is a company that processes personal data for someone else, without decidingwhythe data is processed. Think of it this way: you own the data and determine the purpose, the provider is a trusted craftsman who works with the data on your behalf.
A PUB agreement (sometimes called a data processor agreement or DPA, Data Processing Agreement) is the written agreement that describes exactly what the provider can and cannot do with the data. It is required according to Article 28 of the GDPR, the EU's data protection regulation.
When do I have to have a PUB agreement?
You need a PUB agreement as soon as an external party handles personal data on your behalf. Common examples:
Cloud services and hosting- where your customer data is stored.
Accounting and payroll systems- which handles employee and customer data.
CRM and emailing– with contact lists and customer data.
Web agency or IT consultant- which has access to your website's database.
Support tools and chat services– which stores conversations with customers.
The rule of thumb is simple: if a suppliercan view or storenames, email addresses, social security numbers or other information about real people - then an agreement is needed.
When is it not needed?
If the supplier themselves determines the purpose of the processing, they are not your assistant, but independently responsible for personal data. Then other rules apply. A clear example is when you send data to the Swedish Tax Agency - they decide on their own treatment.
What must the agreement contain?
The GDPR is specific about what a PUB agreement must regulate. The main points:
Object and purpose- which information is processed, why and for how long.
Instructions- the assistant may only process the data according to your documented instructions.
Professional secrecy- everyone who handles the data must be bound by confidentiality.
Security measures– technical and organizational protections, for example encryption and authorization control.
Assistants- the assistant may not employ its own subcontractors without your approval.
Help in case of incidents- the assistant must assist you if there is a data breach or if a customer requests their information.
Deletion or return- what happens to the data when the collaboration ends.
Examination- your right to check that the assistant complies with the agreement.
What happens if I don't have a PUB agreement?
Then you violate the GDPR - even if nothing was actually leaked. The Swedish Privacy Agency (IMY) is the Swedish authority that reviews and can issue sanction fees. In serious cases, the fees can amount to large amounts, and lack of assistance agreements is one of the things the IMY actually looks at in an audit.
A common misunderstanding is that the supplier's standard terms and conditions are sufficient. The responsibility for ensuring that a valid agreement exists always lies with you as the person in charge of personal data - not with the supplier.
That's how you get started - three steps
Map your suppliers.List all external services related to personal data.
Request an agreement.Most reputable suppliers have a ready-made PUB agreement - ask for it and read it through.
Document.Save the agreements together so that you can present them during an audit.
Need help getting it sorted?
Keeping track of personal data, contracts and security quickly becomes messy as the company grows. At ZORC, we help companies build and run websites, systems and AI solutions with data protection built in from the start - and we're happy to figure out which PUB agreements your company needs. Contact us at ZORC and we will review your situation and point out what needs to be in place.
