Customer data processing

How customer data processing is governed

A due-diligence overview of controller and processor roles. Executed customer agreements remain authoritative for each engagement.

Effective and last updated 8 September 2026

Controller and processor roles

For personal data that a customer places in a NeoGRC workspace, the customer normally determines why and how the data is used and acts as controller. NeoGRC processes that data as processor on the customer’s documented instructions. The service agreement and executed Data Processing Agreement define the parties, subject matter, duration, data categories and permitted processing.

NeoGRC separately acts as controller for limited business-administration, security and relationship data described in our Privacy Policy. Customers remain responsible for ensuring that their instructions and use of the platform have an appropriate lawful basis.

Instructions, access and confidentiality

NeoGRC processes customer personal data to provide, secure, maintain and support the contracted service and for other documented instructions agreed with the customer. Personnel and approved service providers are given access only where their role requires it and are subject to appropriate confidentiality obligations.

Workspace permissions, consultant access and external auditor access should be configured by authorised customer administrators. Customers control what information is uploaded and should avoid placing unnecessary personal or highly sensitive information in records or free-text fields.

Security and subprocessors

Technical and organisational measures are designed around access control, tenant isolation, encrypted communications, logging, deployment governance, backup and recovery. The exact contractual measures and service scope are set out in the security schedule or Data Processing Agreement made available during due diligence.

NeoGRC may appoint subprocessors for infrastructure and supporting services. The applicable agreement addresses subprocessor obligations, notice or objection processes and the safeguards used when processing involves an international transfer. Customers can request the current subprocessor information for their service review.

Assistance, incidents and audits

Taking account of the processing and information available, NeoGRC supports customers with data-subject requests, security obligations, impact assessments and regulatory enquiries as specified in the agreement. Suspected personal-data incidents are assessed and communicated to affected customers in line with the contractual notification process.

NeoGRC provides reasonable information to demonstrate compliance with its processor obligations. Security documents, independent evidence when available, questionnaires and proportionate audit arrangements are handled through the customer due-diligence process and the terms of the Data Processing Agreement.

Return, deletion and requesting documents

On termination or expiry, customer-data return and deletion follow the contracted export period, retention requirements, backup cycle and lawful exceptions. NeoGRC does not use customer workspace data for unrelated advertising and does not decide the customer’s regulatory or professional conclusions.

To request the current Data Processing Agreement, subprocessor information or security schedule, email admin@neogrc.com with your organisation, expected use case and the documents required. The executed agreement for a customer relationship is authoritative if it differs from this public overview.