GDPR Data Processing Agreement: Compliance Guide

A GDPR Data Processing Agreement (DPA) is required whenever a data controller uses a data processor. This guide explains Article 28 requirements and how to create compliant DPAs.

What is a Data Processing Agreement?

A DPA is a contract between a data controller (who determines why and how data is processed) and a data processor (who processes data on behalf of the controller). Article 28 of GDPR requires DPAs for all controller-processor relationships.

When is a DPA Required?

Controller-Processor Relationships

• Using cloud services (AWS, Google Cloud, etc.)
• Hiring marketing agencies
• Using payment processors
• Engaging software-as-a-service providers
• Using analytics services

Not Required For

• Controller-to-controller relationships
• Internal processing (same organization)
• Processing your own data

Article 28 Requirements

Processing Instructions

Processor must only process data as instructed by the controller.

Security Measures

Processor must implement appropriate technical and organizational measures.

Sub-Processors

Processor must obtain controller's authorization before engaging sub-processors.

Data Subject Rights

Processor must assist controller in fulfilling data subject rights.

Breach Notification

Processor must notify controller of data breaches without undue delay.

Deletion/Return

Processor must delete or return data at end of processing.

Audits

Processor must allow controller to audit compliance.

Essential Components

Parties and Roles

• Data controller identification
• Data processor identification
• Clear role definitions

Processing Details

• Purpose of processing
• Categories of personal data
• Categories of data subjects
• Duration of processing

Security Measures

• Technical safeguards
• Organizational measures
• Encryption requirements
• Access controls

Sub-Processing

• Authorization requirements
• Sub-processor obligations
• Notification procedures

Data Subject Rights

• Assistance obligations
• Response procedures
• Right to access, deletion, etc.

Breach Procedures

• Notification timelines
• Information requirements
• Cooperation obligations

Termination

• Data return/deletion procedures
• Transition assistance
• Continuing obligations

Best Practices

1. Comprehensive Coverage: Include all Article 28 requirements
2. Specific Details: Be specific about processing activities
3. Regular Updates: Review and update as services change
4. Sub-Processor Management: Maintain list of authorized sub-processors
5. Legal Review: Have privacy lawyers review DPAs

Using Our Template

Our free GDPR Data Processing Agreement template provides Article 28-compliant structure. However, DPAs are complex and should be reviewed by privacy legal counsel, especially for significant data processing.

Conclusion

GDPR-compliant DPAs are essential for legal data processing. Use our template as a starting point and ensure compliance with all Article 28 requirements through legal review.