Service Level Agreement (SLA) Reviews

The need for service level agreement (SLA) reviews

The Protection of Personal Information Act (PoPIA) is clear that an SLA is considered by the Data Regulator as a main control for a Responsible Party to enforce data privacy compliance by their service providers (called by PoPIA as the “Operator”).
A Responsible Party must have SLAs in place with their service providers, establishing specific performance requirements as well as data privacy (including security) compliance requirements for a service provider (e.g., compliance with relevant data privacy policies, procedures, and standards). Over and above data privacy compliance requirements, the SLA also includes amongst other requirements:
  • General contract terms and conditions.
  • Scope of services and product specifications (i.e., agreed-upon deliverables).
  • Delivery timelines (daily, weekly, monthly, yearly tasks).
  • Roles and responsibilities of both parties.
  • Service (performance and compliance) levels expected from the service provider.
  • Service provider performance and compliance reviews by the entity.
  • Provisions for the rectification of non-compliance and / or non-performance by the service provider.
  • The “right to audit” OR the “right to receive an independent SOC 2 report” clause.
  • Penalty clauses for non-compliance and non-performance.
  • Exit and contract termination clauses for both parties.
Futura International assists clients to improve their SLAs, and to ensure that their SLAs enforce best privacy control practices. We can also assist clients (responsible parties) to audit their service providers (operators) for compliances