GDPR Q44

What is a data processing agreement?

Q44. What is a data processing agreement?

Category: Contracts

A data processing agreement (DPA) sets the terms between a controller and processor, ensuring both meet GDPR requirements.

In simple terms

DPAs must include mandatory Article 28 clauses.
They define security, confidentiality, and assistance duties.
Review DPAs regularly and keep signed copies accessible.

Mandatory content

Describe subject matter, duration, nature, purpose, data types, and categories of data subjects. Require processors to act only on documented instructions.

Mandate confidentiality for anyone processing the data.
Require appropriate security measures.
Allow audits or provide audit reports to demonstrate compliance.

Lifecycle management

Specify how and when data will be returned or deleted, rules for subprocessors, and assistance with rights requests, DPIAs, and breaches.

Set notification timelines for breaches.
Require processors to help fulfil controller obligations.
Ensure subprocessors are bound by equivalent terms.

Practical steps to take

Identify all processor relationships and check contracts for Article 28 compliance.
Update templates to include mandatory clauses and liability terms.
Secure signatures and store agreements centrally.
Monitor processor performance via audits or questionnaires.
Review DPAs when services or subprocessors change.

Real-life examples

IT support contract

A controller signs a DPA requiring the provider to keep logs of all system access and report incidents within 24 hours.

Payroll processor

The DPA mandates encryption, staff training, and deletion of payroll files after processing.

Helpful reminders

Do not start processing until a compliant DPA is in place.
Update DPAs to reflect international transfers and safeguards.
Keep evidence of DPA reviews for accountability.

Key takeaway

DPAs protect everyone involved—make them comprehensive and keep them current.

Article references

Article 28 – Processor