Data processing agreement (DPA): when you need one and what it must contain

Every time you give personal data to a tool that works for you, such as an email platform, a CRM, a payment provider or a hosting service, you are in a relationship the GDPR cares about. A data processing agreement, or DPA, is the contract that governs it. This guide explains when you need one and what it has to say.

#What is a data processing agreement?

A DPA is a written contract between a controller, the organisation that decides why and how personal data is processed, and a processor, the organisation that processes it on the controller's behalf. Article 28 requires it. Its purpose is to make sure the processor handles the data only as instructed and with proper safeguards, and that the controller can prove it.

#Controller or processor?

The role depends on what the organisation does, not on its name:

• Controller: decides the purposes and the means. When you collect your customers' data and decide to use it for orders or marketing, you are the controller.
• Processor: acts only on the controller's instructions. Your email platform sending your newsletter, or your hosting provider storing your database, is typically a processor for you.
• Both: a software company is a controller for its own customer accounts and a processor for the data its customers put into the product. It needs DPAs in both directions.

Some vendors are controllers for part of what they do, for example a payment provider that processes data for its own fraud prevention. In that case you may not need a DPA for that part, and the vendor's own terms describe it.

#When do you need one?

• With each vendor that processes personal data for you. Most reputable vendors publish a standard DPA that you accept in your account settings or sign online. Accepting it is the step many businesses forget.
• With your own clients, if you process their data. If you are an agency, a freelancer or a SaaS provider handling your clients' customers' data, your clients should ask you for a DPA, and you should be ready to offer one.

If you only handle personal data for your own purposes and use no processor, you do not owe anyone a DPA, but check your tools first: most small businesses use several.

#What must it contain? The eight obligations

Article 28(3) says the contract must set out the subject matter and duration of the processing, its nature and purpose, the type of personal data and categories of data subjects, and the controller's obligations and rights. It must also require the processor to:

1. Process only on documented instructions from the controller, including for transfers outside the EEA, unless the law requires otherwise.
2. Ensure confidentiality for the people authorised to process the data.
3. Take the security measures required by Article 32.
4. Respect the conditions for engaging another processor (a sub-processor): with the controller's authorisation, and with the same obligations passed down.
5. Assist the controller in answering data subject requests.
6. Assist the controller with security, breach notification, impact assessments and consultation with authorities (Articles 32 to 36).
7. Delete or return the data at the end of the service, at the controller's choice.
8. Make available all information needed to demonstrate compliance and allow audits, including inspections.

The processor must also tell the controller if an instruction, in its view, breaches the GDPR.

#Sub-processors

Processors often use other companies, such as a cloud provider, which are sub-processors. Under Article 28(2) and (4), the processor needs the controller's prior authorisation, either specific or general, and in the general case must tell the controller about changes so it can object. This is why many vendors publish a sub-processor list, and why showing your own list to your customers builds trust.

#Standard clauses from the European Commission

The Commission adopted standard contractual clauses for controller-processor relationships (Implementing Decision (EU) 2021/915). You can use them as a template. They are distinct from the Standard Contractual Clauses for transfers outside the EEA, which cover a different question; our guide to international data transfers explains how they fit together.

#A practical routine

1. List your vendors from your record of processing activities.
2. For each, decide whether it is a processor for you.
3. Find its DPA and accept or sign it. Save a dated copy.
4. Check where it processes the data and which safeguards apply to transfers.
5. Do the same in reverse for your clients if you process data for them.
6. Review when you add or remove a tool.

#FAQ

#Do I need a DPA with Google, Stripe or Mailchimp?

With each vendor that processes personal data on your behalf, you need a DPA. Large vendors include one in their terms or let you accept it in your account, but check that it applies to your account and keep a copy.

#Is a DPA the same as a privacy policy?

No. The privacy policy informs individuals. The DPA is a contract between two companies.

#Can I use the vendor's standard DPA?

Usually yes, and for most small businesses it is the only option. Check that it covers the eight points in Article 28(3) and say which one applies in your records.

#Does a DPA cover transfers outside the EEA?

Not by itself. If the processor sends data outside the EEA, you also need a transfer mechanism such as an adequacy decision, the Data Privacy Framework or Standard Contractual Clauses. Many DPAs incorporate the clauses.

#What if a vendor refuses to sign a DPA?

For a vendor that processes personal data for you, no DPA means you cannot use it lawfully for that purpose. Look for an alternative, or check whether the vendor is actually a controller for what it does.

#Do I need a DPA with my employees' tools?

Yes, when a tool processes personal data for you, including HR and payroll systems. Employees' data is personal data too.

#Sources

• Regulation (EU) 2016/679 (GDPR), Article 28, EUR-Lex
• Commission Implementing Decision (EU) 2021/915 on standard contractual clauses between controllers and processors, EUR-Lex