Data processing agreement (DPA)

GDPR Art. 28(3) prescribes the minimum content of the contract or other legal act binding the processor. It must set out the subject matter and duration, the nature and purpose of processing, the type of personal data and categories of data subjects, and the controller's obligations and rights, and it must stipulate that the processor (a) acts only on documented instructions, including on third-country transfers, (b) ensures staff confidentiality, (c) takes all measures required by Art. 32, (d) respects the conditions in Art. 28(2) and (4) for engaging sub-processors, (e) assists with data subject rights, (f) assists with Arts. 32-36 (security, breach notification, DPIAs and prior consultation), (g) deletes or returns all personal data at the end of the service, and (h) makes available all information necessary to demonstrate compliance and allows for and contributes to audits and inspections. Art. 28(9) requires the agreement to be in writing, which includes electronic form, so click-through terms referencing a published DPA are valid.

Art. 28(7) and (8) allow standard contractual clauses. The Commission adopted SCCs for controller-processor relationships in Implementing Decision (EU) 2021/915, distinct from the transfer SCCs in Implementing Decision (EU) 2021/914, whose modules 2 and 3 already embed Art. 28 terms for transfers outside the EEA. Datatilsynet's standard contractual clauses were the first adopted by a supervisory authority under Art. 28(8), following EDPB Opinion 14/2019, and are widely used as the Danish template (databehandleraftale). Using a standard set does not remove the need to fill in the annexes accurately.

The annexes are where agreements usually fail. They should describe the processing concretely, list the technical and organisational measures at a verifiable level (encryption at rest and in transit, access control model, logging, backup and restore testing, locations), name approved sub-processors with their processing locations, and define the audit mechanism: frequency, whether third-party reports such as ISAE 3000 or ISO 27001 certificates are accepted, and who pays. Breach clauses often set a concrete notification window, for example 24 or 48 hours, because Art. 33(2)'s "without undue delay" must leave the controller time to meet its own 72-hour deadline.

A DPA is only required where there is a genuine controller-processor relationship. Controller-to-controller sharing needs a legal basis and often a data sharing agreement, and joint controllers need an Art. 26 arrangement instead. Labelling a supplier as processor in a DPA does not make it one if it in fact determines purposes, as Art. 28(10) makes clear. The abbreviation also collides with "data protection authority", so contracts should spell out the term. Operationally, the DPA is only as good as its follow-up: controllers are expected to review sub-processor changes and audit evidence at least periodically, as part of supplier management.