Data processing agreement

A data processing agreement (DPA) is the contract the GDPR requires between a controller and a processor. If a client decides why and how personal data is used and you process it for them, you are the processor, and the DPA sets what you may do with that data.

Privacyboard asks you once whether you process data for clients and drafts the agreement only if the answer is yes.

#When the DPA appears

Set Processing for clients to yes in your company profile and go through the "Do I need one?" question. Until then, no DPA is added to your workspace.

#The terms you set

• Subprocessor authorisation. General or specific authorisation of your subprocessors.
• Notice period. How many days' notice you give clients about new subprocessors.
• Breach reporting time. How many hours it takes you to report a personal data breach to the client.

#What is listed

The subprocessor section lists the vendors you marked as serving clients with a confirmed Processor role, with their purpose and region. If a subprocessor processes data outside the EEA, the draft asks how the transfer is protected.

#The checklist

Before you can validate, the checklist shows gaps such as a subprocessor without a region or a company contact missing.

#What the GDPR requires

Article 28(3) lists the content: subject matter, duration, nature and purpose, type of data and categories of people, and the processor's obligations such as acting on documented instructions, confidentiality, security, assistance and deletion or return of data. Articles 28(2) and 28(4) cover subprocessors, and Article 33(2) requires the processor to notify breaches without undue delay.

#Sharing

Download the validated DPA as a PDF, or show it in your privacy center so clients can find it.

#Checking agreements you receive

When you use a vendor that processes data for you, the vendor's own DPA matters too. Privacyboard shows where each vendor's agreement is published and helps you check the points that matter. See Vendor roles.

#FAQ

#Who needs a data processing agreement?

Any company that processes personal data on behalf of another company, such as a software provider handling its clients' customer data.

#Is a DPA mandatory?

Yes. Article 28 requires a binding contract with specific terms between a controller and a processor.

#Is the DPA free?

Drafting and validating are free. Showing it in a public privacy center needs Pro.

#Do I need to list my subprocessors?

Yes. Clients are entitled to know which subprocessors you use.