How to establish a DPA/PUBA with UU

Background: If you, as a PI, are doing research with sensitive personal data, then you are responsible for it. If you are going to work with sensitive personal data on Bianca that is not under the purview Uppsala University, then there needs to be an agreement in place that regulates the partial delegation of responsibility from you to us. This agreement is called a Data Processing Agreement (DPA), Personal Data Assistant Agreement, or Personuppgiftsbiträdesavtal (PUBA).

Instructions for establishing a DPA with UU varies depending on your home university. Typically, DPA are written on the department level and are signed by the department heads.

If you are employed by Karolinska Institutet or Lunds Universitet:

1. The researcher contacts the data protection officer at KI (dataskyddsombud@ki.se) or Lund (dataskyddsombud@lu.se) to verify that KI/Lund is Data Controller (Personuppgiftsansvarig) for the data and the existing template can be used.
2. If KI/Lund is Data Controller and the template can be used:
   1. There are two agreements for each PI. The templates are different for each university, please download and unzip the template for your university here:
      1. Karolinska institutet Zip, 37 kB.
      2. Lunds universitet Zip, 36 kB.
   2. The PI who is responsible for the project must be the one that applies for the project and who is named in the agreements. A person authorised to sign agreements on behalf of their university must sign the Data Processing Agreement (at UU this is the department head, but this can vary from place to place). The Instruction (Uppdrag) may be signed by the PI.
   3. Send us the agreements, using one of two ways:
      1. Electronically: sign each agreement electronically and send them to UPPMAX support.
      2. Physically: Send two signed copies of each agreement (four in total) to UPPMAX (Elisabeth Larsson, P.O. Box 337, 751 05 Uppsala). Include a return address where a completed set of copies can be sent after the UU/IT department head has signed.

If you are employed at Umeå University:

1. Read the information on the UmU webpage on personal data. Contact Pulo and continue from there.
2. Use Lars Eklund or Marcus Lundberg via UPPMAX support (support@uppmax.uu.se) as an initial contact person.

If you are employed elsewhere:

1. Contact UPPMAX support (support@uppmax.uu.se) for information on how to proceed.

EduSign is the recommended service for digital signatures, but other options are also acceptable. Physical mail is also acceptable.