Question 1

When do I need a data processing agreement (DPA)?

Accepted Answer

As soon as an external service processes personal data on your behalf, you need a DPA. That already applies when you use cloud services or external website hosting.

You also need a DPA when you process personal data for someone else.

Question 2

What must a DPA include?

Accepted Answer

A data processing agreement must include specific elements to meet GDPR requirements.

These include:
- a precise description of the nature and purpose of processing
- the types of personal data
- the categories of data subjects
- the rights and obligations of both parties – controller and processor
- rules on security of processing, including technical and organisational measures
- provisions on sub-processing
- provisions on breach notification
- rules on deletion or return of data after processing ends
- provisions on rights to verify compliance with data protection law.

A DPA is the legal basis ensuring processing aligns with the GDPR and protects data subjects’ privacy.

Question 3

How do I create a DPA for my business?

Accepted Answer

Creating DPAs without legal background is difficult and requires data protection knowledge, case law awareness, and drafting options.

To create one yourself you need thorough research and understanding of requirements and authority templates, then adapt a template to your processing – with precise definitions of processing details, security measures, and rights and obligations. You must also review DPAs regularly and document the process for authority checks.

Templates often contain clauses that are unfavourable or invalid for your case. DIY DPAs risk legal disadvantage through insufficient expertise.

Question 4

How do I create a DPA with Dieter?

Accepted Answer

When Dieter creates data processing agreements, all required information is collected through simple questions.

You work step by step through questions answerable in most cases with yes or no (or a predefined choice).

Through smart questions and answer options Dieter ensures all mandatory details are included.

No specialist knowledge is required.

The result is a complete contract with all necessary details, ready to send to your contracting party.

DPAs can be updated whenever needed. Dieter tracks legal changes and provides the current compliant version.

Question 5

Who may create DPAs?

Accepted Answer

We generally recommend having DPAs created by an expert. There are no formal requirements as to who may draft them.

Creation requires high accuracy and attention to many factors. You must also follow legislative and case law developments to produce a sound, individually favourable DPA.

Question 6

What happens if I do not conclude a DPA?

Accepted Answer

Missing a DPA or inadequate clauses can have serious consequences. It is a breach of applicable data protection law (in Germany, the GDPR and notably the BDSG), with fines of up to €20 million or 4% of worldwide annual turnover – whichever is higher.

It can also undermine trust among customers and partners and suggest your business does not take data protection seriously.

Question 7

Data protection is a legal requirement

Accepted Answer

All businesses must meet GDPR requirements. That applies regardless of headcount – including sole traders and solo self-employed professionals.

They must comply with general data protection principles (lawfulness, transparency, purpose limitation, data minimisation, among others), inform data subjects about processing, and implement technical and organisational measures to protect personal data. Smaller businesses are also required to maintain a record of processing activities, a deletion concept, and processes for handling personal data breaches, and more.

With Dieter, you no longer need to worry. We take care of everything you need to meet your legal obligations.

Question 8

Cease-and-desist letters are on the rise

Accepted Answer

Cease-and-desist letters for GDPR violations have increased steadily in recent years. A prominent example is the wave of letters over unlawful use of Google Fonts in summer 2022. Although some of those letters were not lawful, they were based on a Munich Regional Court decision from January 2022. In late 2022, the Court of Justice of the EU also ruled that consumer associations may generally send cease-and-desist letters for GDPR breaches. These and other court decisions triggered further waves. EU-wide GDPR fines reached a new record of €1.2 billion in 2024. Any business that neglects its legal duties can be affected.

Question 9

A legally compliant website is essential

Accepted Answer

A GDPR-compliant website is the first step to protect yourself effectively against cease-and-desist letters. In 2022 alone, there were countless letters over unlawful use of Google Fonts – and pressure continues to grow. Since May 2024, the German Digital Services Act (DDG) has also placed further requirements on website operators. Dieter handles your data protection needs and can create your Impressum as well.

Question 10

More fines for small businesses

Accepted Answer

Data protection authorities have begun conducting inspections without a specific trigger. For companies with fewer than 20 employees, the statistical risk of being affected is over 10:1.

Question 11

Cybercrime in Germany is growing sharply

Accepted Answer

According to a Bitkom study, 87% of German companies were recently victims of a cyber attack. Total damage to the German economy exceeds €289 billion per year – and rising. Implementing mandatory technical and organisational measures (TOM) significantly reduces the risk of being affected.

Question 12

Sharing data requires contractual arrangements

Accepted Answer

Almost all German businesses use services from companies (Google, Microsoft, Meta, Amazon, etc.) that require an international data protection agreement (SCC/JC). Digital service providers also necessarily receive personal data from their clients to deliver the service. In those cases, you must assess whether and with whom data processing agreements (DPAs) are required. Dieter handles that assessment and always provides the right contract.

Question 13

Personal data is a form of currency

Accepted Answer

Since 2022, personal data has been legally treated in some respects like a currency – and with the Data Act in force since 2024, data as an economic asset carries even more weight. Awareness is growing. This data should be as secure as a bank account – and implementing the GDPR helps achieve that.

Question 14

Poor data protection costs customers and business partners

Accepted Answer

More than two thirds of participants in a consumer data and privacy study (commissioned by McKinsey & Company) said they would no longer be customers of – or would stop working with – a company that does not protect their data or shares it without a legal basis. Responsible handling of personal data and meeting legal obligations is a clear competitive advantage.

Question 15

The right to data protection is a fundamental right

Accepted Answer

Everyone has the right to decide which personal (and therefore highly private) data about them is collected, stored, and used. It also helps prevent misuse, fraud, and discrimination. Data protection is a core part of the right to informational self-determination. It protects privacy, identity, and freedom – and is essential for a democratic society. Respecting it should be a matter of course for every business.

Create a data processing agreement (DPA)

Your DPA created in minutes

Essentials: your data processing agreement

DPA obligation explained

Create your DPA in minutes

Ein Blick in unsere All-in-One Datenschutz Software

Datenschutzerklärung mit ein paar Klicks erstellt

Frequently asked questions about data processing agreements

What our
customers say

"Data protection can be this simple!"

"A huge relief when starting out as self-employed!"

"The perfect solution for data protection!"

"Outstanding service with direct 1:1 support"

"Dieter is simply brilliant—from the questionnaire style to support."

"A wonderful tool for all data protection needs"

Die Menschen hinter Dieter

Schützen Sie sich jetzt und aktiv

Auftragsverarbeitungsvertrag erstellen: Art. 28 DSGVO praxisnah umsetzen

AVV erstellen und gleichzeitig Dienstleisterrisiken senken

Warum AVV, Verzeichnis und TOM gemeinsam gedacht werden sollten

Kostenloser Check-up

Individuelle Anforderungen?

KI nutzen. Rechtssicher.