NDA signed before any data access; reviewers sign individual confidentiality agreements.
Data processing agreement (Article 28(3) terms) for personal data; no sub-processor without your written approval.
Review floor: phones locked away, external drives and printing disabled, access removed when a reviewer leaves the queue.
Data handling: work inside your tool or a locked-down desktop, no local copies, data deleted or returned at the end under the contract.
Background checks: identity, education and reference checks on every reviewer.
International data transfers: an International Data Transfer Agreement or standard contractual clauses, as your data law requires.
Regional transfer terms: Association of Southeast Asian Nations (ASEAN) Model Contractual Clauses or local transfer clauses where your law asks for them.
Contract: accuracy targets and turnaround written into the service level agreement (SLA); rework at no cost when a batch misses the agreed target; changes priced first as a change request.