Before launching any UW activity that involves sharing personal data with an external (non-UW) organization or contractor — from business processes to systems to surveys — your first step is to create a data processing agreement (DPA). A DPA outlines how you plan to use personal data and is especially important for clarifying the purpose and use of data as well as roles and responsibilities with an external organization or contractor.

The workflow on this page will lead you through the process. After that, the workflow will guide you in creating a data inventory about the purpose and use of personal data, determining whether the personal data you are using are high risk, and describing how you can make informed decisions about data processing.

While detailed, carefully following this process will save you time and effort in the long run, and ensure you are addressing compliance obligations that are related to personal data.

Read more:

University of Washington Privacy Office. Data Processing Agreement. https://privacy.uw.edu/take-action/manage-data-requests-sharing/dpa/