When an institution wants to use a service, it needs to check whether a data processing agreement between the institution and the service provider is necessary.
SURF has drafted a model data processing agreement that can be used. An institution can also negotiate their own DPA.