The data processing agreement supplies the common instructions, confidentiality, security, assistance, subprocessor, audit, return/deletion and incident duties. Its schedules and any applicable transfer instruments form part of the proposed arrangement.

For POPIA-regulated processing, references to controller and processor include responsible party and operator, and personal information includes covered information about identifiable existing juristic persons. Beetl processes with the customer's knowledge/authorisation, preserves confidentiality and maintains risk identification, safeguards, verification and improvement appropriate to section 19. Section 5's immediate compromise notice applies. Sub-operators are bound to corresponding duties. Before a section 72 transfer, the parties document the applicable lawful ground and enforceable protection; other countries' transfer documents are not automatically a South African compliance finding. Customer and Beetl retain their own applicable Information Officer, PAIA and privacy-governance duties.