Establish roles for each processing flow
Roles depend on who determines purpose and means. Use the Danish authority’s guidance to examine business and supplier responsibilities; one label does not necessarily cover every processing flow.
Source: Datatilsynet: rollefordeling
Collect only what the task needs
An initial contact request can often be described without sensitive details. Agree minimum fields and a suitable route for more confidential material. Do not ask for passwords or complete clinical records in open chat.
Review the actual supplier chain
Request a current inventory of recipients, purposes, data types, locations and relevant agreements. Procora’s server location alone does not establish where an optional model, email or channel provider processes data. Assess source protection and access for the chosen configuration.
Distinguish records and deletion flows
Review retention separately for conversations, enquiries, accounts, audit reports and delivery logs. Deleting a conversation does not establish deletion of related records, backups or provider copies. Use the current privacy policy and the responsible party’s specific response to a request.
Use the worksheet for review, not certification
This checklist is general information, not legal approval of your configuration. Obtain appropriate advice for sensitive data or regulated sectors. Check current agreements and actual processing before sharing information.
Use the worksheet
Version 15 October 2026. Fill in your own facts; illustrative values are not results or an agreed service.
QUESTIONS FOR A SUPPLIER What purpose and which data? Who determines purpose and means for each processing flow? Which instructions and agreement apply? Which providers receive data, where and on what basis? What retention, deletion and backup rotation apply to each record type? Who handles rights requests? How are access, export and deletion tested? Who approves changes, and when is the assessment reviewed?
Sources and scope of review
First-party documentation reviewed 15 October 2026. Vendor statements are not independent product tests. Recheck your actual package and agreement.
Choose the next useful action
Compare the current scope before requesting setup. An educational guide does not activate a product or accept a paid engagement.