Data Processing Agreement (UK GDPR Article 28)

1. Subject Matter, Duration, Nature & Purpose of Processing

• Subject Matter: Provision of the CantraCare cloud care management platform for adult social care and nursing homes.
• Duration:For the term of the Controller's active SaaS subscription plus a 30-day offboarding export window.
• Data Subjects: Care home residents, relatives/Lasting Powers of Attorney (LPAs)/visitors, and care home employees/agency staff.
• Categories of Data: Identity, contact details, NHS number, date of birth, special-category health and clinical care data (care plans, eMAR, NEWS2 observations, risk assessments, body maps, CQC incident reports), and staff HR/DBS compliance data.

2. Mandatory UK GDPR Article 28(3)(a)–(h) Processor Obligations

1. Documented Instructions — Art 28(3)(a): CantraCare shall process Personal Data only on documented instructions from the Controller, including with regard to international transfers, unless required to do so by UK law.
2. Confidentiality — Art 28(3)(b): CantraCare ensures that all personnel authorised to process Personal Data have committed themselves to statutory and contractual confidentiality obligations and completed annual NHS Data Security and Protection Toolkit (DSPT) training.
3. Security of Processing (TOMs) — Art 28(3)(c) & Art 32: CantraCare implements Technical and Organisational Measures including: AES-256-GCM field-level encryption at rest (`nhsNumber`, `dob`, `niNumber`, `dbsNumber`, `certificateNumber`, `mfaSecret`, `phoneNumber`, `addressLine1`); TLS 1.2+ in transit with HSTS; strict JWT `tenantId` isolation; mandatory TOTP MFA for privileged roles; and tamper-evident HMAC-SHA256 chained audit logs with automated nightly verification.
4. Sub-Processor Controls — Art 28(3)(d): The Controller grants general written authorisation for the sub-processors listed in Schedule 1 below. CantraCare shall notify the Controller at least 30 days in advance of any intended addition or replacement of a sub-processor, giving the Controller the opportunity to object on data protection grounds, and imposes equivalent Article 28(3) obligations on every sub-processor.
5. Assistance with Data Subject Rights — Art 28(3)(e): CantraCare provides built-in self-service Subject Access Request (SAR) JSON and PDF dossier export tools (`/api/data-rights/residents/:id/export` and `/api/data-rights/staff/:id/export`) and rectification workflows to enable the Controller to respond to UK GDPR Chapter III requests within statutory timeframes.
6. Breach Notification & DPIA Assistance — Art 28(3)(f): CantraCare shall notify the Controller without undue delay (and in any event within 24 hours of confirmation) after becoming aware of a Personal Data Breach, and assists the Controller with UK GDPR Articles 32–36 obligations (security, ICO 72-hour breach reporting, CQC notifications, and Data Protection Impact Assessments).
7. Return or Deletion on Termination — Art 28(3)(g): At the choice of the Controller upon termination of services, CantraCare shall provide a complete export of all Controller data and subsequently delete or irreversibly anonymise all copies unless UK law requires storage.
8. Audit & Inspection Rights — Art 28(3)(h): CantraCare shall make available to the Controller all information necessary to demonstrate compliance with Article 28 (including DSPT assertions, penetration test summaries, and audit chain integrity reports) and allow for and contribute to audits conducted by the Controller or a mandated auditor.

Schedule 1: Authorised Sub-Processors

Schedule 2: Model Care Home Resident & Staff Privacy Notice Template (A-04)

Care Home Controllers may adapt the template below for their Resident Admission Packs and Staff Handbooks to satisfy UK GDPR Articles 13 & 14: