You probably need a data processing agreement (DPA) if your assistant handles personal data on your behalf and the EU or UK GDPR applies to your business. Under those laws, a business that uses someone else to process personal data for it generally needs a written contract with set terms, and that can include a self-employed assistant working remotely from another country. Whether GDPR applies to you depends on your situation, so take advice. This is general information, not legal advice. DonutJobs helps you build the agreement into the hire, with a pool of 50,000+ pre-tested virtual assistants and an ATS on Agency or Pro to keep your notes and terms with each candidate.
Why Data Terms Belong in Your Hiring Plan
The best time to settle data terms is before the offer, when you know what the role will touch. If a customer support or admin assistant will see names, emails, order details or messages, the agreement should say what they may do with that data. Agreeing it early means your chosen candidate can say yes or no with the facts in front of them, and your first week starts without surprises.
When GDPR May Apply
The GDPR can apply to a business based in the EU or UK, and to some businesses elsewhere that offer goods or services to people in the EU or UK or monitor their behaviour. If your customers or leads are in those places and your assistant handles their personal data, check whether it applies to you. If you are based elsewhere, other privacy laws may apply as well, and they vary by country and by state or region.
Key Terms in Plain English
- Personal data: any information that relates to an identifiable person, such as a name, email address, phone number, order history or messages
- Controller: the business that decides why and how the data is used. Usually this is you
- Processor: a person or company that handles the data on the controller's behalf and on its instructions. A remote assistant working through your systems for your purposes often fits this role
- Data processing agreement (DPA): the written contract between controller and processor that sets out the rules
- International transfer: sending or giving access to personal data from the UK or EU to a person or system in another country. Remote access from abroad can count
What a DPA Normally Covers
The exact requirements are set by law and your adviser should confirm them. In general, a DPA records:
- What data is processed, whose data it is and why
- That the assistant acts only on your documented instructions
- A duty of confidentiality for everyone who sees the data
- Security measures, and rules on using other helpers or tools
- Help with requests from individuals, and prompt notice of any security incident
- What happens to the data when the work ends: return or deletion
A Short Checklist for Working With a Remote Assistant
- Map what the assistant will touch. List the systems, files and inboxes and the personal data in each.
- Share only what the work needs. If the role needs first names and order numbers, do not open full customer histories.
- Put the terms in writing. Add a DPA or equivalent terms to your agreement, in plain English, and have your adviser review them.
- Ask about transfers. If UK or EU personal data will be accessed from another country, there are rules on making that lawful, and they differ between the UK and the EU. Your adviser can tell you which apply.
- Use individual logins. Give the lowest level of access that works and remove it when the work ends.
- Approve tools in advance. If your assistant uses AI tools or other software with your data, check those tools' data terms first.
- Agree the exit. Say what is returned or deleted and by when, and ask for confirmation in writing.
Read the Regulators
Official guidance is the best source. The ICO explains what a controller and processor contract must include under UK GDPR. The European Commission keeps an overview of EU data protection rules, and the Australian regulator explains how privacy law treats personal information. Where you, your clients and your assistant are based decides which rules apply, so take advice before you finalise your agreement.
Screening Questions About Data Handling
Hiring is where good data habits start. Add two or three of these to your interview, or to your Formbuilder knockout questions on Agency or Pro:
- Have you handled customer or client records before, and in which tools?
- What do you do if you send a message to the wrong person or open the wrong file?
- Which devices and internet connection will you use for this work?
- Are you comfortable signing a confidentiality and data agreement before access starts?
The device and connection question links neatly to the internet and hardware audit that DonutJobs profiles show. Our candidate verification checklist lists what to confirm before you extend an offer.
Build Data Terms Into Your Hire on DonutJobs
DonutJobs profiles show results from an internet and hardware audit, an English communication test, a live typing speed test and a recorded voice sample, so you can shortlist with a clear picture of each candidate. Our explainer on data and payment security on DonutJobs shows how information and transactions on the platform are protected.
- Create your free account and post your role. Mention in the post that a confidentiality and data agreement is part of the offer.
- On Agency or Pro, add the data-handling questions above to the Formbuilder as knockout questions, so candidates answer them before you spend time interviewing.
- Shortlist using the profile results, then chat with candidates in the app. On Agency or Pro the chat syncs to the ATS, so the agreed terms and your notes sit on the candidate record.
- Send your agreement with the offer and grant access in stages, as in our 30 day onboarding guide.
- You pay your hire directly, with no per-hire fee, no placement fee and no commission on wages. Keep your own record of who can see what.
Practical Use Cases
An ecommerce store with customers in the UK can use the checklist before giving an assistant access to order data. A marketing agency handling client lists can add processing terms before a new assistant starts. A founder who is unsure if GDPR applies can use the first two steps to prepare for a conversation with an adviser. For the working relationship itself, see our guide on virtual assistant versus contractor.
Common Mistakes to Avoid
A common mistake is assuming that working with an individual freelancer means the rules do not apply. Another is treating a confidentiality agreement as a DPA, when a DPA has particular content. A third is forgetting that giving remote access to data from another country can be a transfer. Rules differ between the EU, the UK and other places and change over time, so confirm the current position with a qualified adviser. This article is general information, not legal advice.
FAQ
Do I need a DPA for a freelance virtual assistant?
If the assistant processes personal data for you and GDPR applies to your business, a written contract with the required terms is generally needed. Check with an adviser.
Is an NDA the same as a DPA?
No. An NDA covers confidentiality. A DPA sets out specific rules for how personal data is handled, including security, other helpers, breaches and deletion.
Does giving a remote assistant access count as a transfer?
It can, if the assistant is in a different country from the data's origin. Transfer rules may then apply.
What if my business is not in the UK or EU?
GDPR can still apply in some cases, and other privacy laws may apply. Ask an adviser about the rules that cover your customers.
Where do I keep my hiring records and agreed terms?
On Agency or Pro, the ATS holds your pipeline stages, notes and bulk actions, and in-app chat syncs to it, so each candidate's terms and messages sit in one place.
Data protection is easier when you plan it before the work starts. Map the data, limit the access, put the terms in writing and ask for advice on the parts you are unsure about.
Start with candidates whose profiles show real test results, then put the agreement in place. Create your free DonutJobs account or browse the talent pool.