What is a data processing agreement (DPA)?

DPA: definition and significance

Anyone who does not process personal data themselves but entrusts a service provider with it needs a data processing agreement under Art. 28 GDPR. The client remains the controller and stays liable towards data subjects and supervisory authorities for lawfulness. The service provider, the processor, may process the data only on documented instructions and may not use it for its own purposes.

Typical processors are hosting and cloud providers, newsletter and CRM services, and providers for payroll, document destruction or IT support with access to systems. Anyone who decides on purposes and means jointly with another party is a joint controller (Art. 26) and needs a different kind of arrangement.

Mandatory contents under Art. 28 GDPR

The contract must define the subject matter, duration, nature and purpose of the processing, the type of data and the categories of data subjects. It must also bind the processor to certain obligations. It can be concluded in writing or in an electronic format; many providers offer it as an online acceptance.

• Processing only on the controller’s documented instructions
• Confidentiality obligations for staff
• Appropriate technical and organizational measures (Art. 32)
• Rules and approval for sub-processors
• Support with data subject rights, data breaches and impact assessments
• Deletion or return of data at the end of the contract
• Audit and verification rights for the controller

Real-world example: a retailer with an online store, newsletter and fulfillment

A specialist retailer runs an online store with a hosting provider, sends newsletters through an external tool and has packages shipped by a logistics provider. For each of these relationships, the retailer must check whether personal data is processed on its behalf. That is the case for the host and the newsletter tool, so a DPA is needed; for the shipping provider, it depends on the specific arrangement.

The review reveals that no DPA was ever concluded for the newsletter tool and that the host uses subcontractors in a third country. The retailer obtains the missing contract, asks for the list of sub-processors and supplements its record of processing activities.

Common mistakes and limits

A DPA does not replace checking the provider. What matters are the actual protective measures, which should be described in an annex to the contract. Often an up-to-date list of sub-processors is missing, or the contract is never terminated after a project ends and the data stays where it is.

If data is transferred to a country outside the EU, the DPA alone is not enough. A transfer mechanism is also required, such as an adequacy decision or standard contractual clauses. A missing but required DPA is a separate violation that can attract fines. The data under the agreement also remains your responsibility, so check regularly that the contract still matches actual use.

What companies should look out for

Keep a list of all service providers with data access and check for each whether a DPA exists, is up to date and matches the actual data flows. This also applies if you are a processor yourself, for example as an agency with access to client systems: your customers then need a contract with you. Nano Concepts concludes corresponding agreements for projects involving data access. This article does not replace legal advice.