Data Protection Impact Assessments — Notification Providers
DPPA 2019 §33(1) requires the data controller (ZFA InsureLink) to maintain a record of processing activities. This folder holds one DPIA per third-party notification provider. Every SMS / WhatsApp / email dispatch is a data transfer to the named provider; the DPIA documents what leaves the platform, the legal basis, the safeguards, and the data-subject-rights routing.
Files below are living documents — update when a provider's contract, data-processing addendum, or ingress region changes.
| Provider | DPIA | Cross-border? | Recorded in DataTransferConsent as |
|---|---|---|---|
| Africa's Talking (SMS) | africas-talking.md | Kenya | sms_kenya |
| Meta / Facebook WhatsApp Cloud | whatsapp-cloud.md | United States | whatsapp_us |
| SMTP relay | smtp.md | see file | email_smtp (when foreign) |
| Sanctions screening provider | sanctions.md | see file (UK / US / Uganda-local) | sanctions_offshore |