Data Processing Agreement (GDPR Article 28): Clause-by-Clause Checklist

When you need one

You need a data processing agreement (DPA) whenever a processor processes personal data on your behalf, following your instructions and for your purposes: hosting, CRM, payroll, email delivery, support tools, analytics run for you. Before choosing one, you may only use processors that provide sufficient guarantees of appropriate technical and organisational measures (Article 28(1)). The contract must be in writing, which includes electronic form (Article 28(9)).

What the contract must describe

Article 28(3) requires the contract to set out:

• the subject-matter and duration of the processing;
• the nature and purpose of the processing;
• the type of personal data and the categories of data subjects;
• the obligations and rights of the controller.

Generic wording such as "all data the customer uploads" is common but weak. Describe the actual data and people involved, usually in an annex.

The eight processor obligations (Article 28(3)(a) to (h))

The processor must also immediately inform you if, in its opinion, one of your instructions infringes data protection law (Article 28(3), last subparagraph).

Sub-processors

• A processor may not engage another processor without your prior specific or general written authorisation (Article 28(2)).
• With general authorisation, it must inform you of intended additions or replacements, giving you the opportunity to object.
• It must impose the same data protection obligations on the sub-processor by contract, and remains fully liable to you for the sub-processor's performance (Article 28(4)).

Standard clauses you can use

The contract may be based on standard contractual clauses (Article 28(6)). The European Commission adopted standard clauses between controllers and processors in Implementing Decision (EU) 2021/915. Do not confuse them with the separate standard clauses for international transfers: a processor outside the EEA may need both. An approved code of conduct or certification can help demonstrate sufficient guarantees (Article 28(5)).

What to check in a vendor's DPA

1. Are all eight obligations of Article 28(3) there, not just security and confidentiality?
2. Does the breach clause say how fast they notify you? GDPR requires "without undue delay" (Article 33(2)); a concrete number of hours helps you meet your own 72-hour deadline.
3. Is there a current sub-processor list with locations, and a way to be told of changes and to object?
4. If data leaves the EEA, which transfer mechanism applies, and can you get a copy?
5. Do audit rights exist in practice, for example through a recent independent report, with inspection as a fallback?
6. What happens to the data at the end, and within what time?
7. Is the description of data and data subjects specific enough to match your records of processing?

A processor that decides for itself becomes a controller: under Article 28(10), a processor that infringes GDPR by determining the purposes and means of processing is considered a controller for that processing.

A DPA template that covers all of Article 28. The Vendor Security Assessment Pack includes a data processing agreement template, plus a vendor security questionnaire, a security requirements addendum, an onboarding checklist, a risk register and an exit plan template.

Sources

• Regulation (EU) 2016/679 (GDPR), Articles 28 and 33, EUR-Lex
• Commission Implementing Decision (EU) 2021/915 on standard contractual clauses between controllers and processors, EUR-Lex

Related tools