Data processing agreement (DPA): when you need one, what it must contain and when you don’t

In brief

• Processing on behalf of a controller exists when a service provider processes personal data only on your instructions and pursues no purposes of its own. In that case a contract under Art. 28(3) GDPR is mandatory, before processing begins.
• Typical processors: hosting providers, cloud storage, email providers, newsletter tools, CRM and SaaS providers, payroll bureaus, document shredding services, IT service providers with access to your systems.
• No DPA needed with independent controllers: tax advisers, lawyers, auditors, banks, postal and parcel services, insurers. They decide on the means and purposes of processing themselves.
• The DPA has eight mandatory contents. If one is missing, the contract is incomplete. With large providers the DPA is usually part of the terms of service, but you still have to check and document it.

What processing on behalf of a controller is

The GDPR knows two roles. The controller decides on the purposes and means of processing (Art. 4(7) GDPR). The processor processes personal data on behalf of the controller (Art. 4(8) GDPR), that is, bound by instructions and without any decision of its own about what happens to the data. A newsletter provider that stores your subscriber list and sends out mailings when you click is the classic example. It may not do anything with the addresses other than what you tell it to.

Because you are handing data out of your own control, Art. 28 GDPR requires three things of you: you may only use processors that provide sufficient guarantees for the security of the data (paragraph 1). You must conclude a contract with a defined minimum content (paragraph 3). And you remain responsible towards the data subjects and the supervisory authority, even if the mistake happens at the service provider. The DPA is therefore not a form for the filing cabinet but the document with which you organise this responsibility.

When do you need a DPA?

Whenever an external service provider processes or stores personal data on your behalf, or can even just access it on a regular basis. The amount of data does not matter. The most common cases in everyday business:

The same applies in the other direction: if you process data for other companies, for example as an agency, IT service provider or software vendor, you are the processor and must offer your customers a DPA. Agencies will find the right procedure on the page Data protection for agencies.

When don’t you need a DPA?

The most common misconception in practice is the DPA with the tax adviser. It is not necessary, and for a clear reason: tax advisers, lawyers and auditors process the data of your customers and employees on their own responsibility under their professional law. They are not bound by instructions and are therefore controllers themselves. For tax advisers this has even been written explicitly into the law since 2021 (§ 11(2) of the German Tax Advisory Act, StBerG). The German Data Protection Conference (DSK) has summarised the distinction in its short paper no. 13. You do not need a DPA with:

• Professionals bound by professional secrecy: tax advisers, lawyers, notaries, auditors, doctors and company doctors.
• Banks and payment service providers for transfers and card payments. They act under their own regulatory obligations.
• Postal and parcel services for transporting consignments.
• Insurers, debt collection agencies with their own decision-making latitude, detective agencies and other service providers that determine themselves how they carry out the task.
• Tradespeople, cleaning companies, suppliers who do not handle personal data in terms of content. A cleaning service that walks through the office in the evening is not commissioned processing but a case for a confidentiality obligation and locked cabinets.

The mandatory contents under Art. 28(3) GDPR

Art. 28(3) GDPR prescribes the minimum content. First the framework: subject matter and duration of the processing, nature and purpose, type of personal data, categories of data subjects, and the obligations and rights of the controller. Then eight specific provisions that the contract must impose on the processor:

In addition, the processor must inform you if it considers an instruction to be unlawful (paragraph 3, third sentence). And paragraph 10 makes clear: if the processor itself determines the purposes and means, it becomes a controller, with all the obligations and full liability.

Sub-processors: Art. 28(2) and (4) GDPR

Almost every cloud provider uses service providers of its own: data centres, support companies, analytics tools. It may only engage these further processors with your prior written authorisation, either for each individual case or as a general authorisation with a duty to inform you of changes (paragraph 2). In practice, provider DPAs contain a general authorisation plus a list of sub-processors and a right to object within a set period. That is permissible as long as you are actually informed. So subscribe to the change notifications of your most important providers. The processor must impose the same obligations on its sub-processors and is liable to you for them (paragraph 4).

US providers and other third countries

If the provider or one of its sub-processors is located outside the EU and the EEA, you need, in addition to the DPA, a basis for the transfer under Chapter V of the GDPR. For the USA, since 10 July 2023 that has been the adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795): if the provider is certified under it, the DPA is sufficient. You can check this in the public list of the US Department of Commerce. Without certification, or for other third countries, you need the standard contractual clauses of the EU Commission (Implementing Decision (EU) 2021/914), Module 2 for controller to processor, plus a documented assessment of whether the law of the destination country actually supports the clauses in practice. Both bases belong by name in your privacy policy.

Form, templates and who provides the contract

The DPA must be in writing, which includes an electronic format (Art. 28(9) GDPR). A DPA accepted by click in the provider’s customer account is valid. Keep a dated copy. With large providers the DPA is included in the terms of service (Microsoft “Data Protection Addendum”, Google Cloud “Data Processing Terms”, Mailchimp “Data Processing Addendum”). You do not have to negotiate anything, but you do have to check whether it covers the eight mandatory contents and assign it to your record of processing activities.

For service providers without a DPA of their own, such as your regional IT support company or a payroll bureau, you need a template. With Implementing Decision (EU) 2021/915, the EU Commission has published standard contractual clauses specifically for data processing agreements; they are legally sound but very formal. The responsibility for ensuring that a suitable DPA is in place lies in every case with the controller, meaning you. So do not wait for the service provider to send you a contract on its own initiative.

When must the DPA be concluded?

Before the first processing. The DPA is the prerequisite for you being allowed to pass on the data at all. If a service is already in use and the contract is missing, obtain it immediately and document the date. That does not cure the breach retroactively, but it ends it, and that is exactly what counts in a later inspection. At the end of the contract, point (g) applies: have the deletion or return confirmed and file the confirmation with your record of processing activities.

What happens without a DPA?

A missing or incomplete DPA is a breach of Art. 28 GDPR and falls within the fine bracket of up to 10 million euros or 2 percent of worldwide annual turnover (Art. 83(4)(a)). In every inspection, the first thing supervisory authorities ask for is the record of processing activities and the associated DPAs. A folder with gaps is a folder with fine potential. On top of that comes the practical risk: without a DPA, in the event of a data breach at the service provider you have no contractual notification deadline, no right to information and no provision on liability. You find out from the press and are liable anyway.

Checking a provider’s DPA in ten minutes

1. 1Roles clear? The provider is named as processor, you as controller. If it says “independent controller”, you do not need a DPA but must check whether the disclosure is permissible at all.
2. 2Subject matter, data, data subjects described? If there is only a placeholder, fill it in.
3. 3Only on instructions? No right for the provider to use your data for its own purposes, product improvement or AI training, unless anonymised.
4. 4TOM as an annex? At least a description following the usual control areas, better still a certificate.
5. 5List of sub-processors and right to object? With a duty to inform you of changes.
6. 6Notification deadline for data breaches? Specified in hours, not “without undue delay”.
7. 7Deletion or return at the end of the contract? With a deadline and proof.
8. 8Third country covered? Data Privacy Framework or standard contractual clauses named.
9. 9Audit right or certificates? One of the two must be present.
10. 10Date and version saved? Copy filed with the record of processing activities, change notifications subscribed to.

Creating a DPA with Dieter

For service providers without a contract of their own, and for your own customers when you are the processor yourself, Dieter generates the DPA from a short questionnaire: roles, subject matter, data categories, sub-processors, TOM as an annex. The contract is versioned and updated when the law changes. The overview of all processors sits right next to the record of processing activities. Details on the page Create a data processing agreement.

Conclusion

The DPA is the tool with which you organise a responsibility you cannot hand over. The work lies less in the contract text than in the overview: which service providers process data for you, which of them are processors, is there a complete contract in place for each one, and who checks the change notifications? If you can answer these four questions at any time, you have Art. 28 GDPR under control.