←  All terms
A
Security & Compliance

Data Processing Agreement

A data processing agreement defines how a service provider processes personal data on behalf of a controller under GDPR.

A data processing agreement defines how a service provider processes personal data on behalf of a controller under GDPR. The appropriate design depends on the data, risk, and jurisdiction and requires both technical and organizational review. The concept is closely related to GDPR and Hosting.

Read more

GDPR

Hosting

Consent Management Platform

FAQ

Data Processing Agreement

What changes with a data processing agreement for providers outside the EU?
The agreement alone is not enough, because transferring data to a third country needs its own legal basis under GDPR, such as standard contractual clauses. Subprocessors outside the EU also need review. Which solution fits is a case-by-case question for legal counsel.
How does a DPA differ from joint controllership?
In processing on behalf, the provider acts on instructions, while in joint controllership several parties jointly determine purposes and means. The two setups call for different agreements. The classification depends on the specific facts and belongs in legal review. A template for one case does not automatically fit the other.
Who is responsible for concluding a data processing agreement?
The controller must ensure that an agreement exists, but in practice the service provider often supplies a template. Both parties review and sign it. A standard contract that is handed over does not replace checking whether purpose, data types, and subprocessors match the actual use.
What content does a data processing agreement typically include?
Typical elements are subject matter and duration of processing, type of data, categories of data subjects, instruction rights, technical and organizational measures, and rules on subprocessors. Art. 28 GDPR lists the minimum components. The concrete wording is agreed by legal and data protection professionals.
When is a data processing agreement required?
Under Art. 28 GDPR, it is required when a service provider processes personal data on documented instructions on behalf of a controller, such as a hosting provider or a newsletter service. Whether a given relationship actually qualifies as processing on behalf is a legal assessment.