Data Processing Agreement DPA

A data processing agreement is required whenever a controller has a processor handle personal data on its behalf. Article 28(3) of the GDPR says that such processing "shall be governed by a contract or other legal act" that binds the processor to the controller. The provision sets no threshold of size or volume. A firm that stores client files with a cloud provider, runs payroll through a bureau or uses a hosted client portal needs one with each supplier that acts as its processor.

The controller may use only processors that provide "sufficient guarantees" of compliant processing (Article 28(1)). The agreement is where those guarantees become binding.

The abbreviation DPA is also used for a data protection authority, meaning the supervisory authority that enforces the GDPR in a member state.

A data processing agreement must first describe the processing: its subject matter and duration, its nature and purpose, the type of personal data, the categories of data subjects, and the controller's obligations and rights. Article 28(3) then lists eight undertakings by the processor, in points (a) to (h). The table gives them in the order of the text, with points (e) and (f) on assistance taken together.

One more duty is attached to point (h). The processor must tell the controller immediately if it thinks an instruction infringes data protection law. Many agreements add commercial terms, such as liability caps and notice periods. Those are for the parties to agree. They cannot remove anything on the list.

A data processing agreement must set the terms on which the processor may bring in another processor, often called a sub-processor. Article 28(2) forbids it without the controller's prior written authorisation. The authorisation can be specific or general. Under a general authorisation the processor must inform the controller of any intended addition or replacement, "thereby giving the controller the opportunity to object".

The duties then pass down the chain. Article 28(4) requires the processor to impose "the same data protection obligations" on the other processor by contract. If that processor fails, the first processor "shall remain fully liable to the controller". A firm that reads a supplier's agreement should look for the list of sub-processors and the notice it gets of changes.

No. Article 28(9) requires the contract to be "in writing, including in electronic form". Article 28 does not prescribe a type of signature.

Article 28(6) allows the agreement to be based on standard contractual clauses. The European Commission may lay such clauses down, and a supervisory authority may adopt them (Article 28(7) and (8)). The Commission has adopted a set for controllers and processors. Using it is optional.

Processing without a data processing agreement infringes Article 28, even if nothing goes wrong with the data. Article 83(4)(a) places the obligations of the controller and the processor under Articles 25 to 39 in the first tier of administrative fines. The ceiling is EUR 10 million or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. The provision names both parties, so both are exposed.

Without agreed terms the controller also has no contractual right to audit the supplier or to get the data back at the end. A processor that goes beyond its instructions and decides purposes and means itself is treated as a controller for that processing (Article 28(10)).

No. Article 28 applies only where processing is carried out "on behalf of a controller". A provider that determines the purposes and means of its own processing is a controller under Article 4(7). Two separate controllers do not sign a processor contract for that processing. If the two decide the purposes and means together, they are joint controllers under Article 26.

The question comes up with providers that deliver a regulated service under duties the law places on them directly. The role follows from who determines the purposes and means of the processing in question. A legal duty on the provider is one indication, not the test. Article 28(3)(a) expects that a processor may be required by law to process data outside its instructions and remain a processor. Where EU or member state law itself determines the purposes and means, that law may also provide who the controller is (Article 4(7)). For a provider that is a controller, Article 6(1)(c) is one possible lawful basis: processing "necessary for compliance with a legal obligation to which the controller is subject".

The answer depends on the facts of each processing activity. One provider can be a controller for some processing and a processor for other work it does on a customer's instructions. A firm should ask the provider which role it takes for which data, and on what legal ground.