The VCDPA requires that a controller (such as, the entity that determines the purpose and means of processing personal data) and a data processor (such as, an entity that processes personal data on behalf of the controller) enter into an agreement that includes certain data processing terms. The terms of this agreement must include certain provisions, such as: instructions for processing data, types of data subject to processing, nature and purpose of processing, duration of processing, and rights and obligations of both parties. Furthermore, the contract must include obligations associated with subcontracting, assessments, duty of confidentiality, deletion or return of personal data, and demonstrate a processor's compliance with the VCDPA.
Microsoft may be considered a data processor in some circumstances when providing services to our customers. If that is the case, the terms of the Microsoft Products and Services Data Protection Addendum (DPA) already meet the requirements of the VCDPA since these requirements are similar to the GDPR's contractual requirements; there is no need to update your organization's contract with Microsoft. As set out in the DPA, Microsoft complies with all laws and regulations applicable to its provision of the Online Services, which would include the VCDPA.