Data processing agreement (DPA)
Last updated: 23 July 2026
This page is a courtesy summary for English-speaking visitors. The legally binding version of Mandato’s DPA description is the Spanish one.
The Spanish page explains that Mandato acts as a data processor under Article 28 GDPR for the personal data your law firm processes in the platform (clients, contacts, matters). It summarises our contractual commitments — processing only on your documented instructions, confidentiality, security measures (AES-256 encryption, EU hosting, tenant isolation, audit log), a published list of authorised sub-processors with flow-down obligations, assistance with data-subject rights, breach notification without undue delay and within 72 hours, deletion or return of data on termination, and audit rights — with the full DPA text and signed copies available on request.