{"id":17387,"date":"2023-11-16T16:07:00","date_gmt":"2023-11-16T15:07:00","guid":{"rendered":"https:\/\/comasystem.dk\/gdpr-contract-management\/"},"modified":"2025-07-31T12:18:56","modified_gmt":"2025-07-31T10:18:56","slug":"gdpr-contract-management","status":"publish","type":"post","link":"https:\/\/comasystem.dk\/en\/gdpr-contract-management\/","title":{"rendered":"GDPR & contract management"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

GDPR & contract management<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

How to ensure data protection and compliance with privacy regulations<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tPosted November 16, 2023\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

We have a naturally strong focus on data protection and compliance. Even before the General Data Protection Regulation (GDPR) Act came into force on 25 May 2018, COMAsystem was developed with \u201cPrivacy by Design\u201d in mind. This means that data placed with us is fundamentally protected through our technological design, i.e. the technology package on which the solution is organised. <\/strong><\/p>

As you know, the background of legislation is designed to increase focus on the use of personal data by requiring companies and organisations to know where, how and why they use personal data \u2013 as well as where and how data is stored, shared and deleted.<\/p>

Business operations aren\u2019t getting less digital, and neither is the amount of data \u2013 and that\u2019s why we focus on the main areas you need to be aware of in order to secure your sensitive personal data in your contract management.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Third-country transfers and data processing agreements<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The term third-country transfers refers to the sharing of personal data by your organisation with external third parties outside the EU\/EEA, such as suppliers, service providers, partners and subsidiaries.<\/p>

Exchanging data with your suppliers, service providers, partners and subsidiaries can be necessary, especially as more and more software solutions move to the cloud (Software As A Service) \u2013 such as contract management.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\u201cIt\u2019s your obligation as a data controller\u201d<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In order to comply with GDPR requirements, you must be particularly aware that if they process personally identifiable data entrusted to you \u2013 as a data processor of, for example, your customers\u2019 and employees\u2019 personal data, they must provide information about what data is processed, how data is stored and the purpose of this data processing in the Data Protection Agreement (DPA) concluded between them and you.<\/p>

It is your obligation as a data controller to ensure that data entrusted to you is processed under the same conditions as you have received it \u2013 therefore you must at least consider the following:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Where is the data stored?<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Is it stored within the EU\/EEA on equipment controlled by the supplier?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Which deletion policy is in place?<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Is data deleted when it is deleted on your premises and when the co-operation ends?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Do they use subcontractors?<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Do they make third country transfers in the solution they offer you?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
A procedure in the event of a security breach?<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Is it described how this is handled?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\u201cThe supplier must be able to provide an ISAE 3000 Type II declaration. This is usually a good indicator of how the supplier works with both IT security and GDPR\u201d <\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Christian Richter-Pedersen<\/strong>
CEO & Partner, COMAsystem<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

These points should all be included in the data processing agreement \u2013 you can see the data processing agreement that forms the basis for the processing of data we do on behalf of our customers here, it is based on the Danish Data Protection Agency\u2019s template.<\/p>

Ensure that the supplier has an ISAE 3000 Type II declaration, this is the specific declaration type that applies, among other things, in relation to the General Data Protection Regulation and the Data Protection Act (GDPR) \u2013 it should be seen as a framework for control objectives and control activities that, for example, relate to what security measures and processes a data processor has set up and how they work.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Automatic deletion of sensitive personal data<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

You cannot store sensitive personal data forever, but as long as there is an active relationship between you or a legal requirement to store it, you can keep it.<\/p>

According to the Danish Bookkeeping Act, accounting material must be stored for 5 years \u2013 but what about the contracts and agreements you enter into on an ongoing basis with suppliers and customers, all of which form the basis for your invoices, credit notes and vouchers?<\/p>

The GDPR does not set a fixed framework for how long you can store sensitive personal data \u2013 you must therefore define how long after the end of the collaboration that you still consider your relationship to be active.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\u201cRetire your printer, scanner and ballpoint pen\u201d<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

For example, you\u2019ve entered into a three-year contract with a customer that doesn\u2019t renew and the relationship ends, but you can see from your historical customer data that a certain amount returns after four years \u2013 therefore you can argue in favour of storing customer data containing personal data for up to seven years.<\/p>

When using contract management, it\u2019s therefore important to keep track of your deletion policies as data retention periods can vary from purchase, sales and employment contracts.<\/p>

In our dedicated contract management system, we follow the standard five years of the Danish Bookkeeping Act, but it is up to you as users to define your standard deletion deadlines on purchase, sales and employment contracts or to specify a customised deletion date for each contract \u2013 in line with what you have disclosed to your customers, suppliers and partners.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\u201cThe data we store on behalf of our customers is always the customers\u2019 data \u2013 it is the customer who decides on the duration of storage and possible deletion\u201d<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Christian Richter-Pedersen<\/strong>
CEO & Partner, COMAsystem<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Centralisation and digital signatures<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

When you store your contracts in a contract management system, you can centralise your contract management processes, the storage of contract data and associated documents.<\/p>

Centralized storage and management, combined with user management, allows each contract manager to monitor and respond to events related to individual contracts when required. This could be a change of contract status from tender to approved and in operation or terminated when the contractual relationship ends.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\u201cTake one step at a time\u201d<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Retire your printer, scanner and ballpoint pen and sign your contacts digitally so that the entire process is electronic and logged on the contract in question \u2013 making it possible to ensure that the signatory is validated, for example via MitID.<\/p>

If you choose the COMAsystem contract management system, you can send documents for digital signing by one or more parties, ensuring that everyone receives the final agreement with designated e-signatures and the documents are automatically saved to the contract to which they are linked.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\u201cA contract management system enables consistent storage and updating of contract data so that it is not passed around via email and avoid personal data flowing uncontrollably within the organisation\u201d<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Christian Richter-Pedersen<\/strong>
CEO & Partner, COMAsystem<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Get the processes under control<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In our experience, companies and organisations want to be in control of their personal data processing \u2013 where you are in the process of mapping and setting up procedures often depends on resources.<\/p>

One of the places where many are already 100% digitised is in their bookkeeping \u2013 there are established procedures for approving invoices and the accounting system stores all relevant invoices, credit notes and vouchers in accordance with the Danish Bookkeeping Act.<\/p>

Now you “just” need the rest, the correspondence, contracts and agreements behind the incoming and outgoing accounting documents – this can seem confusing. Our recommendation is that you do the same as if you were climbing Mount Everest – take one step at a time.<\/p>

With preparation and the right equipment, you get there safely and faster, which is why we developed COMAsystem – an easy-to-use and intuitive contract management system that doesn’t drain your organization of resources. We support you throughout the onboarding process and structure the solution to match your workflows.<\/p>

Take the first step \u2013 book an online demo and learn how we can secure your contract data and data protection compliance.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tDownload the Danish Data Protection Authority's template<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tRead more about ISAE 3000<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tDownload our ISAE 3000<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

We have a naturally strong focus on data protection and compliance. Even before the General Data Protection Regulation (GDPR) Act came into force on 25 May 2018, COMAsystem was developed with \u201cPrivacy by Design\u201d in mind. This means that data placed with us is fundamentally protected through our technological design, i.e. the technology package on which the solution is organised. <\/p>\n","protected":false},"author":3,"featured_media":16922,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[156],"tags":[],"class_list":["post-17387","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-en"],"_links":{"self":[{"href":"https:\/\/comasystem.dk\/en\/wp-json\/wp\/v2\/posts\/17387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/comasystem.dk\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/comasystem.dk\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/comasystem.dk\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/comasystem.dk\/en\/wp-json\/wp\/v2\/comments?post=17387"}],"version-history":[{"count":19,"href":"https:\/\/comasystem.dk\/en\/wp-json\/wp\/v2\/posts\/17387\/revisions"}],"predecessor-version":[{"id":23877,"href":"https:\/\/comasystem.dk\/en\/wp-json\/wp\/v2\/posts\/17387\/revisions\/23877"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/comasystem.dk\/en\/wp-json\/wp\/v2\/media\/16922"}],"wp:attachment":[{"href":"https:\/\/comasystem.dk\/en\/wp-json\/wp\/v2\/media?parent=17387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/comasystem.dk\/en\/wp-json\/wp\/v2\/categories?post=17387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/comasystem.dk\/en\/wp-json\/wp\/v2\/tags?post=17387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}