Create a top-quality data processing agreement (DPA)

When is a DPA required?

What matters is who decides on the purposes and essential means of the processing. If a service provider processes the data only for you and on your instructions, it is a processor (Art. 4(8), Art. 28 GDPR). Typical examples are hosting and SaaS, IT support with data access, payroll, newsletter delivery and document destruction. No DPA is needed if the provider acts on its own responsibility, such as lawyers, banks or postal services. If you determine purposes and means jointly, an arrangement on joint controllership under Art. 26 GDPR is required instead. The benchmark for this distinction is the European Data Protection Board’s (EDPB) Guidelines 07/2020.

Misclassification causes harm in both directions. Without a required DPA, fines are possible and the disclosure to the provider loses its privileged status. A DPA concluded without need suggests a role that does not actually exist. Mixed roles are tricky: if a provider also uses the data for its own purposes, such as benchmarks or product improvement, it is a controller to that extent. Such own use is carved out of the DPA, not “permitted” in it.

Mandatory content under Art. 28(3) GDPR

The agreement sets out the subject matter and duration, the nature and purpose of the processing, the type of personal data, the categories of data subjects and the obligations and rights of the controller. In particular, it obliges the processor to:

• process data only on documented instructions (point a)
• ensure the confidentiality of the persons involved (point b)
• take technical and organizational measures under Art. 32 GDPR (point c)
• respect the conditions for engaging sub-processors (point d)
• assist with data subject rights, security, breach notifications and data protection impact assessments (points e and f)
• delete or return the data at the end of the contract (point g)
• provide evidence and allow audits, including inspections (point h)

The official EU template as a basis

The European Commission has adopted standard contractual clauses for processing within the EU (Implementing Decision (EU) 2021/915, Art. 28(7) GDPR). They cover all mandatory content, are accepted by the supervisory authorities and spare you discussions about the core text. You only add what the template leaves open or what your case requires, such as costs, liability or fixed notification deadlines. These additions must not contradict the clauses.

In practice, the annexes determine the quality. Without a concrete description of the data, purposes, technical and organizational measures and sub-processors, even a complete contract text remains an empty shell.

Form and timing

The DPA must be in writing, which includes electronic form (Art. 28(9) GDPR). A handwritten signature is not required. Providers with high-volume business can incorporate the DPA into their terms, provided customers can take note of it before concluding the contract. For standard contractual clauses for international transfers, however, an express signature is advisable.

Timing is crucial: the agreement must be in place before the first access to the data. Concluding it afterwards does not cure a violation that has already occurred. The range of fines follows Art. 83(4)(a) GDPR.

Who provides the DPA?

The obligation to conclude the agreement applies to controller and provider alike. Usually the provider presents its own template, especially in high-volume business and with large cloud providers that rarely negotiate. Your own draft is still worthwhile as a controller: as a benchmark to spot deviations quickly and as a basis for negotiation. Providers, in turn, benefit from a uniform template they can offer to all customers.

The five negotiation points

Beyond the mandatory content, the parties usually negotiate the same points:

• Sub-processors: specific authorization or general authorization with a right to object. Under a general authorization, the provider must actively inform about changes and allow a reasonable period. A mere online list without notification is not enough.
• Audit rights: a tiered approach is permissible, starting with certificates and audit reports, then requests. On-site inspections must not be excluded, however.
• Costs: whether support services and audits are paid for is negotiable. Cost provisions must not deter audits, though. A free allowance is a common compromise.
• Liability: limitations of liability are critical from the controller’s perspective, because it is fully answerable to data subjects and authorities and its recourse would be cut short.
• Notification deadline: the EU template requires personal data breaches to be notified “without undue delay”. A fixed deadline, such as 48 hours, helps the controller meet its own 72-hour deadline under Art. 33 GDPR.

Third countries: USA, Data Privacy Framework and TIA

If a US provider is certified under the EU-US Data Privacy Framework, a DPA based on the EU template is sufficient. It makes sense to add an obligation to maintain the certification and a fallback solution in case the framework ceases to apply. Without certification, and in other third countries without an adequate level of protection, the standard contractual clauses for international transfers are needed in the matching module (Implementing Decision (EU) 2021/914). In addition, a transfer impact assessment (TIA) evaluates the legal situation in the recipient country and must be repeated regularly.

Common mistakes

These weaknesses come up particularly often in practice:

• Blanket data categories such as “customer data” instead of specific categories with examples
• Overlooked sensitive data, including data on criminal offenses under Art. 10 GDPR
• A TOM annex that merely repeats the wording of Art. 32 GDPR
• Sub-processors listed by brand name instead of full company name, country and service, or a SaaS solution supposedly without any sub-processors
• Permitting own use by the provider in the DPA instead of carving it out
• Concluding the agreement only after processing has already started