If your organization uses a cloud host, payroll platform, analytics service, email provider, or customer support tool, another company may process personal data for you. Where that company is acting as your processor, the DPA describes the specific rules for that work. It should match the service and data flow, not just repeat broad privacy promises.
This guide explains what a DPA does, how to identify the parties’ roles, what GDPR Article 28 requires, and how to review security, sub-processors, transfers, and exit terms. For related documents, see our guides to GDPR compliance, legal pages for course creators, and policies for affiliate marketers.
What Is a Data Processing Agreement?
A data processing agreement is a binding contract or other legal act governing a processor’s handling of personal data for a controller. It describes what work the processor performs, what instructions it follows, which safeguards and assistance it provides, and how the parties handle the data when the service ends. Organizations often call it a DPA, data processing addendum, or processor agreement.
Controller
Determines the purposes and essential means of processing for the activity.
Processor
Processes personal data on behalf of the controller under its documented instructions.
DPA
Records the agreed processing scope, duties, cooperation, and accountability steps.
Why a DPA Matters for Vendor Governance
A DPA turns vendor due diligence into operational commitments. It gives the organization a place to define how instructions are issued, how incidents are escalated, what the vendor must disclose about its sub-processors, and what evidence supports its security claims. It also helps teams avoid relying on a generic “we protect your data” statement.
For the controller
- Document the purpose, data, and permitted instructions.
- Assess the processor’s guarantees and relevant safeguards.
- Coordinate rights requests, incidents, and impact assessments.
- Maintain evidence of vendor and sub-processor oversight.
For the processor
- Know what processing is authorized and what is out of scope.
- Define secure access, confidentiality, and incident contacts.
- Set a workable approval and notice process for sub-processors.
- Agree how audits, assistance, and termination will work.
Visual: the processor relationship
The agreement supports governance; it does not transfer every legal responsibility to the vendor or replace security review, privacy notices, records of processing, or internal controls.
GDPR Article 28 and Other Legal Requirements
Under GDPR Article 28, when processing is carried out on behalf of a controller, the controller must use a processor that provides sufficient guarantees. Processing must be governed by a binding contract or other legal act describing the processing and required obligations. The official GDPR text on EUR-Lex sets out these terms in Article 28(3) and additional rules for sub-processors in Article 28(4).
The UK Information Commissioner’s Office offers a practical contract checklist for controllers and processors, including the processing details, instructions, confidentiality, security, sub-processors, assistance, end-of-contract handling, and audit provisions. The ICO notes that its guidance is under review following changes to UK data protection law, so check current local requirements before relying on it.
| Required processing detail | Questions to answer |
|---|---|
| Subject matter and duration | Which service is covered, and when does processing begin and end? |
| Nature and purpose | What operations does the vendor perform and for what defined purpose? |
| Data and people | Which personal data types and categories of data subjects are in scope? |
| Controller obligations and rights | What instructions, approvals, and oversight rights will the controller exercise? |
A DPA is not automatically required for every supplier contract. First determine whether personal data is processed and whether the supplier acts as a processor, an independent controller, or a joint controller for the activity.
Key DPA Clauses to Review
Use the table as a review checklist. Article 28 specifies required content for GDPR processor arrangements; additional commercial terms can make the agreement workable for the particular service.
| Clause | What it covers | Review question |
|---|---|---|
| Processing details | Subject matter, duration, nature, purpose, data types, data subject categories, and the controller’s rights and obligations. | Does the annex match the live service and data map? |
| Documented instructions | The processor acts on the controller’s documented instructions, including for international transfers unless law requires otherwise. | Can instructions be changed and recorded safely? |
| Confidentiality | People authorized to process the data are bound by confidentiality obligations. | Who can access the data and under what duties? |
| Security | The processor takes appropriate technical and organizational security measures. | Are controls proportionate to risk and documented? |
| Sub-processors | The processor obtains the required prior authorization and flows equivalent data protection obligations down the chain. | How are additions, objections, and flow-down terms handled? |
| Individual rights | The processor assists the controller, where possible, with requests to exercise data subject rights. | What technical help and response path are available? |
| Compliance assistance | The processor assists with security, breach notifications, impact assessments, and prior consultation where applicable. | How quickly will the processor notify the controller? |
| End of service | At the controller’s choice, data is returned or deleted after services end, unless law requires retention. | How are backups, legal holds, and residual copies handled? |
| Audits and evidence | The processor makes information available and allows for and contributes to audits and inspections. | Can the controller obtain assurance without unreasonable friction? |
Security terms should be concrete
The contract can reference a security schedule, but it should connect to evidence and change processes. Consider access controls, encryption where appropriate, vulnerability management, resilience, backup and restoration, personnel training, testing, and how material security changes are communicated. Do not promise a particular certification or control unless the processor has verified it.
Sub-processor changes
Require authorization in the chosen model, advance notice, and a workable objection route.
Incident cooperation
Name the contact path, information to share, preservation steps, and escalation responsibilities.
Exit and deletion
Specify export format, deletion timing, backup treatment, and exceptions required by law.
A Visual Vendor Review Workflow
The following charts use an illustrative example only for a small company assessing a fictional support and analytics vendor. The scores, data categories, and task counts are not survey results, legal benchmarks, or claims about a real provider. Replace them with your own inventory and review records.
The contract preparation sequence
Map
Describe the real data, people, purpose, systems, locations, and retention.
Classify
Determine each party’s role for this specific processing activity.
Contract
Set instructions, security, assistance, sub-processor, and exit terms.
Operate
Assign owners for incidents, requests, audit evidence, and changes.
Review
Recheck the agreement when scope, vendors, or locations change.
International Data Transfers Need Separate Attention
An Article 28 DPA does not, by itself, authorize every international transfer. Map where personal data is accessed, hosted, backed up, and supported from, including by sub-processors. If a transfer mechanism is required, identify it separately and keep the DPA’s instructions and sub-processor terms consistent with it.
Map locations
Include primary hosting, support access, backups, and downstream providers.
Select a mechanism
Check whether an adequacy decision or an appropriate safeguard applies to the transfer.
Assess and document
Review transfer risks and supplementary measures where required; assign an owner for updates.
The EU standard contractual clauses for international transfers are distinct from Article 28 controller-processor terms; identify the required transfer instrument separately and obtain legal review when needed.
How to Negotiate and Manage a DPA
- Start with the processing map. Record data subjects, data fields, purposes, systems, locations, retention, and subprocessors.
- Classify roles by activity. Confirm who determines purposes and means. If the vendor has its own purpose, assess whether that activity is a separate controller relationship.
- Review the vendor’s security evidence. Assess safeguards in context, including access, resilience, incident response, and relevant independent assurance.
- Negotiate workable mechanics. Set named contacts, practical notice routes, change notices, audit evidence, and escalation steps.
- Coordinate related documents. Keep the DPA consistent with the main service agreement, privacy notice, transfer terms, and sub-processor list.
- Assign an owner and review triggers. Revisit the agreement when the service, data categories, sub-processors, processing locations, or legal requirements change.
Common DPA Mistakes
Copying a template without completing schedules
Blank or generic data descriptions make the agreement hard to apply and audit.
Treating role labels as conclusive
Actual decisions about purpose and means determine the role for each activity.
Using “industry standard security” without detail
Identify the control commitments, evidence, and change process that fit the risk.
Ignoring sub-processors
Know which providers are involved, how changes are communicated, and what protections flow down.
Setting an unrealistic incident deadline
Choose a clear operational notification period and require updates as facts develop.
Confusing processor terms with transfer clauses
A separate transfer mechanism may be needed even when an Article 28 DPA is signed.
Ignoring deletion from backups
Define backup lifecycle and exceptions so return or deletion terms can be implemented.
Signing and forgetting
Maintain a contract inventory and review on meaningful service or vendor changes.
Draft a DPA, Then Tailor It to the Service
A DPA generator can help structure the first draft and remind you of common clauses. It cannot determine whether the vendor is a processor, choose a transfer mechanism, verify security claims, or resolve negotiation questions. Complete the processing schedule and compare the draft with the vendor’s current service terms.
Free DPA Generator
Create a customizable starting draft for a controller-processor relationship, then review it with the people responsible for privacy, security, procurement, and legal decisions.
Open the DPA GeneratorFor the other side of your privacy documentation, explore our Privacy Policy Generator and website policy writing guide.
Frequently Asked Questions
Conclusion
A useful DPA describes the real processing relationship and gives both parties a process they can follow. Map the data first, classify the roles accurately, document the Article 28 terms that apply, and align the agreement with security evidence, sub-processors, transfer safeguards, and exit procedures.
Before signing
Confirm the scope, role, processing schedule, security commitments, and workable operational contacts.
After signing
Track sub-processor changes, test incident routes, retain evidence, and review the DPA when the service changes.
Need a companion privacy notice?
Use our Privacy Policy Generator to draft a notice that describes your organization’s actual data practices.