A data processing agreement (DPA) governs the data protection obligations between a controller and a processor. Under Article 28(3) GDPR, such an agreement or another appropriate legal instrument is required where a service provider processes personal data on behalf of a controller. In particular, the DPA specifies which data is processed for which purposes, which instructions apply and how the protection of personal data is ensured.
When must a data processing agreement be concluded?
A DPA is required where a service provider processes personal data on behalf of a controller and the arrangement therefore constitutes processing by a processor within the meaning of Articles 4(8) and 28 GDPR.
Typical examples include:
- Website hosting involving the processing of personal data
- Storage of personal data with cloud service providers
- Outsourced payroll processing by service providers acting under the controller’s instructions
- Operation of customer management systems by external IT service providers
The agreement must be concluded before the processing on behalf of the controller begins. However, not every business relationship with an external company requires a DPA. The decisive factor is whether the service provider processes personal data on behalf of the controller or independently determines the purposes and essential means of the processing.
What must a DPA contain?
Article 28(3) GDPR sets out the key mandatory contents of a data processing agreement.
These include, in particular:
- Subject matter and duration: What processing activities are carried out and for how long.
- Nature and purpose: Which processing operations take place and for what purposes.
- Data and data subjects: Which types of personal data are processed and which categories of individuals are affected.
- Instructions: As a general rule, the processor may only process personal data on the controller’s documented instructions.
- Confidentiality and data security: Persons authorised to process personal data must be bound by confidentiality obligations. Appropriate technical and organisational measures must be ensured.
- Sub-processors: The conditions for engaging further service providers must be specified.
- Assistance obligations: The processor must assist the controller, in particular with data subject rights and certain data protection obligations.
- Return and deletion: Once the processing has been completed, personal data must, at the controller’s choice, be returned or deleted, unless a statutory obligation requires its retention.
- Evidence and audits: The processor must provide the information necessary to demonstrate compliance with its obligations and allow for audits and inspections.
A DPA must genuinely reflect these statutory requirements. Merely labelling a document as a data processing agreement is not sufficient.
Who is responsible for concluding and complying with a DPA?
Under Article 28(1) GDPR, the controller must ensure that it only engages processors that provide sufficient guarantees for GDPR-compliant processing.
This includes assessing appropriate technical and organisational measures before engaging the service provider. The controller must also ensure that the processing is governed by a contract or another appropriate legal instrument that meets the requirements of Article 28 GDPR.
The processor, in turn, is obliged to comply with its contractual obligations and the statutory data protection obligations that apply directly to it.
A DPA does not relieve the controller of its responsibility for ensuring that the processing of personal data is lawful.
Does a data processing agreement have to be concluded in writing?
Under Article 28(9) GDPR, the data processing agreement or other legal instrument must be in writing. Electronic form is expressly permitted.
A DPA can therefore be concluded and documented electronically, for example. A handwritten signature on paper is not strictly required.
What matters is that a binding agreement is concluded and that its contents can be evidenced.
What are the consequences of a missing or defective DPA?
Where processing on behalf of a controller takes place without the requirements of Article 28 GDPR being met, this constitutes a breach of data protection law.
This may result in supervisory authority measures and administrative fines under Articles 58 and 83 GDPR.
Even where an agreement has been concluded, it does not protect the parties against infringements if essential mandatory provisions are missing or the agreed data protection measures are not actually implemented.
Furthermore, where damage has been caused by an infringement of data protection law, a claim for compensation may arise under Article 82 GDPR, provided that the relevant conditions are met.
Practical example: Missing DPA with a cloud service provider
A company uses an external cloud service to store customer data. The provider processes the data on behalf of the company and supplies the technical infrastructure.
Although personal data is being processed, the company has not concluded a DPA with the cloud provider.
The contractual arrangement required under Article 28(3) GDPR is therefore missing. The company must ensure that a GDPR-compliant DPA is concluded and that the service provider provides sufficient data protection guarantees.
legal data assessment: Before engaging external service providers, companies should assess whether a DPA is required. The existence of an agreement alone is not sufficient: its mandatory contents must be complete and the agreed security measures must actually be implemented. Standard agreements provided by cloud and IT service providers should therefore be reviewed against the requirements of Article 28 GDPR before they are used.
Legal basis
Articles 4(7) and 4(8), 28, 32, 58, 82 and 83 GDPR.
Frequently asked questions about data processing agreements
What does the abbreviation DPA stand for?
DPA stands for data processing agreement. It governs the data protection obligations between a controller and a processor under Article 28 GDPR.
Is a DPA also required for small companies?
Yes. The obligation to conclude a DPA does not depend on the size of the company. The decisive factor is whether the processing of personal data on behalf of a controller takes place.
Who must draft the data processing agreement?
The GDPR does not specify which contracting party must provide the draft agreement. However, both the controller and the processor must ensure that their agreement meets the statutory requirements.
Does a separate DPA have to be concluded for every service provider?
A DPA is required for each processing arrangement involving a processor. However, several processing activities may be covered by a single agreement, provided that all statutory requirements are addressed.
Does a DPA replace the consent of data subjects?
A DPA does not replace any legal basis required under Article 6 GDPR. Whether consent is necessary or another legal basis applies depends on the specific processing activity.
Related terms.
Technical and organisational measures (TOMs) Technical and organisational measures are the specific precautions a company takes to protect personal data. Art. 32 GDPR Standard contractual clauses (SCCs) Standard contractual clauses are model contracts issued by the European Commission that provide appropriate safeguards for transfers of personal data to third countries. Art. 46(2)(c) GDPR 