GDPR Templates for IT Service Providers: DPA + TOM
TL;DR
- IT service providers are regularly processors under Art. 4(8) GDPR, for example in hosting, as a managed service provider, as a SaaS provider or as a cloud reseller.
- A DPA under Art. 28 GDPR is mandatory as soon as personal data are processed on behalf of and on the instructions of the customer. Anyone who processes customer data for their own purposes is, to that extent, a controller in their own right (Art. 4(7) GDPR; where the Regulation is infringed, Art. 28(10)).
- Minimum content, not an exhaustive list: Art. 28(3) GDPR sets out what the contract must stipulate “in particular”. It must be in writing, including in electronic form (Art. 28(9)).
- Describe the TOM under Art. 32 GDPR in concrete terms: the structure of eight control areas is a widespread practice structure, not a statutory catalogue.
- Sub-processors only with prior written authorisation, specific or general. Under a general authorisation, the customer must be informed of every intended change; the GDPR sets no minimum period.
- Transfers to the USA: the adequacy decision (EU) 2023/1795 applies only to organisations on the Data Privacy Framework List. The appeal C-703/25 P had not been decided as at 17 August 2026.
- Personal data breach: the processor notifies it to the controller without undue delay (Art. 33(2)), with no statutory deadline in hours. The customer notifies the supervisory authority without undue delay and, where feasible, within 72 hours.
- Own record under Art. 30(2) GDPR: the exemption for fewer than 250 employees (Art. 30(5)) as a rule does not apply to IT service providers.
Main article: DPA Template Art. 28 GDPR — the full article on processing on behalf from the controller's perspective, with all mandatory contents and review questions.
This page shows the other side: which documents an IT service provider should keep ready itself as a Data Processor. The GDPR Guide gives the overall picture of the obligations; further specialist articles are in the GDPR topic area.
1. Role: Controller or Processor?
The GDPR aligns the chain of obligations with two roles. The controller is whoever determines the purposes and means of the processing (Art. 4(7) GDPR); for an IT service provider, this is as a rule the customer. The processor is whoever processes personal data on behalf of the controller (Art. 4(8) GDPR). The IT service provider then processes data for the customer, not about the customer.
A pure software sale without data access, for example an on-premise licence that the customer operates itself, is not a case of processing on behalf. As soon as the provider stores personal data in its systems or accesses them, there is processing: Art. 4(2) GDPR includes, among other things, storage, retrieval and consultation. Art. 28(10) GDPR draws the line to the provider's own responsibility: where a processor, in infringement of the Regulation, determines the purposes and means itself, it is considered to be a controller in respect of that processing. What independent controllership looks like for professional secrecy holders is shown in the article GDPR for Tax Advisors and Law Firms.
2. Typical IT Service Provider Constellations
The following business models regularly lead to processing on behalf in practice:
- Web hosting and server hosting: the customer stores databases, web applications or files on the provider's infrastructure.
- Managed Service Provider (MSP): remote maintenance, patch management and monitoring with access to customer systems, often including HR data.
- Cloud reseller: the service provider markets cloud services of a hyperscaler and sits between the hyperscaler and the end customer. What the customer has to check in a cloud migration is shown in the cloud migration checklist.
- SaaS provider: its own platform into which the customer feeds personal data, for example CRM, project management or HR software. The ten product obligations for this are set out in the article GDPR for SaaS Providers.
- IT consulting with data access: database migration, ERP customisation or training on live systems.
- Development with customer data: test and staging systems into which production customer data are loaded.
For a cloud reseller, a two-tier contractual chain arises: a DPA between the customer and the reseller, and a documented contract between the reseller and the hyperscaler that imposes the same data protection obligations on the latter under Art. 28(4) GDPR. Irrespective of their role under the GDPR, managed service, hosting and cloud providers in Germany may also fall under NIS2: Annex 1 of the BSIG lists in the digital infrastructure sector, among others, providers of cloud computing services, providers of data centre services and managed service providers (nos. 6.1.4, 6.1.5 and 6.1.10); the size thresholds are governed by § 28 BSIG. The details are set out in the article NIS2 for Cloud Providers and SaaS Providers. For the same target group, the article HinSchG for IT Providers + MSSPs covers whistleblower protection.
3. Data Processing Agreement (DPA) under Art. 28
Art. 28(3) GDPR sets out the minimum content: the subject matter and duration, the nature and purpose of the processing, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. Beyond that, the contract stipulates “in particular” the obligations under points (a) to (h); the list is therefore not exhaustive. For an IT service provider's standard DPA this means: the legal building blocks from documented instructions (point (a)) to evidence and inspections (point (h)) are the same for all customers, while the description of the processing belongs in an annex per product, for example “web hosting with a dedicated VM” with a term linked to the main contract. Where the service provider considers that an instruction infringes the GDPR or other data protection provisions, it informs the customer immediately (Art. 28(3) subparagraph 2). The contract must be in writing, which may also be in electronic form (Art. 28(9)); a purely oral agreement does not meet this formal requirement. The complete table of mandatory contents with review questions is in the DPA article, the short definition in the glossary under DPA.
A fully drafted data processing agreement under Art. 28 GDPR with clauses on instructions, confidentiality, TOM, sub-processors, duties to assist as well as erasure and return is included in the GDPR Kit (module 03 · processing on behalf).
4. Annexes to the DPA
Three standardised annexes have proven themselves in practice. They turn a framework contract into a contract for the specific processing relationship.
| Annex | Content | Reference |
|---|---|---|
| Annex 1: Description of the processing | Types of data, categories of data subjects, purposes, processing locations per product | Art. 28(3) subparagraph 1 GDPR |
| Annex 2: TOM description | technical and organisational measures with their concrete status (see section 5) | Art. 28(3)(c) GDPR Art. 32 GDPR |
| Annex 3: List of sub-processors | Name, address, processing location, task, date of authorisation | Art. 28(2) and (4) GDPR |
5. TOM under Art. 32 GDPR
Art. 32(1) GDPR requires appropriate measures for a level of security appropriate to the risk and names for this purpose pseudonymisation and encryption, ensuring confidentiality, integrity, availability and resilience, the timely restoration after an incident and a process for regular testing (points (a) to (d)). What processors additionally have to demonstrate for the TOM is covered in depth in the article TOM under Art. 32 GDPR; for the definition, see the glossary under TOM.
For the description in Annex 2, a structure of eight control areas is widespread in practice. It is not a statutory catalogue; the standard remains Art. 32(1) GDPR.
| Control area | Examples at an IT service provider |
|---|---|
| Admission control | physical access to the data centre and server rooms |
| Access control | authentication on systems, MFA for administrators, password policy |
| Authorisation control | privilege management on a need-to-know basis, logging of access |
| Transfer control | encryption in transit (TLS), VPN for remote maintenance |
| Input control | logging of who entered or changed which data and when |
| Instruction control | binding to instructions, management of sub-processors |
| Availability control | backup, disaster recovery, UPS, redundancy |
| Separation control | tenant separation, separate test and production environments |
The description should be concrete enough for a customer or a supervisory authority to be able to follow its effectiveness. Phrases such as “data is protected” are not sufficient for this. This also includes ensuring that employees with access to data process them only on instructions (Art. 32(4) GDPR).
6. Sub-Processors (Art. 28(2) and (4))
A processor does not engage another processor without prior specific or general written authorisation of the controller (Art. 28(2) sentence 1 GDPR). Two models are possible:
- Specific authorisation: each new sub-processor is approved individually. For providers with many customers, this is hardly manageable in practice.
- General authorisation: the customer approves a list. The service provider informs it of every intended addition or replacement and thereby gives it the opportunity to object (Art. 28(2) sentence 2 GDPR).
The GDPR sets no minimum period for this information. The objection period must be laid down in the contract; a period of, for example, 30 days is a practice recommendation, not a statutory requirement. The same data protection obligations as in the provider's own DPA must be imposed on the sub-processor by contract (Art. 28(4) sentence 1). Where the sub-processor fails to fulfil its data protection obligations, the initial processor remains liable to the controller for the performance of that other processor's obligations (Art. 28(4) sentence 2).
7. Third-Country Transfers (Chapter V GDPR)
Where personal data are transferred to a Third Country, for example to a US hyperscaler, Chapter V GDPR applies in addition. The transfer needs a basis:
- Adequacy decision (Art. 45 GDPR): for the USA, Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-US Data Privacy Framework applies. It covers only organisations included in the Data Privacy Framework List of the U.S. Department of Commerce. The Commission monitors its application on an ongoing basis and may suspend, amend or repeal the decision under Art. 45(5) GDPR.
- Standard data protection clauses of the Commission (Art. 46(2)(c) GDPR) for recipients without an adequacy decision.
- Binding corporate rules (Art. 46(2)(b), Art. 47 GDPR) for transfers within a group of undertakings.
On the DPF, the General Court of the EU dismissed the action for annulment on 3 September 2025 (T-553/23, Latombe); the appeal C-703/25 P has been pending since 31 October 2025 and had not been decided as at 17 August 2026. Anyone relying on the DPF checks the listing of every US recipient and follows the proceedings. For standard data protection clauses, the CJEU in Case C-311/18 (Schrems II) requires a level of protection essentially equivalent to that in the Union, to be assessed also in the light of the legal order of the recipient country; in practice this is documented as a transfer impact assessment (TIA). As a supplementary measure, the EDPB Recommendations 01/2020 name, for example for the hosting of backups, strong encryption before transmission with reliable key management. Further reading: Schrems II + DPF Update 2026 and, for the exit scenario, DPF Collapse Plan B.
8. Data Breach Notification (Art. 33 + 34)
Where the processor becomes aware of a personal data breach, it notifies it to the controller without undue delay (Art. 33(2) GDPR); the provision sets no deadline in hours, and under Art. 33 GDPR the processor has no notification obligation of its own towards the data protection supervisory authority. The controller notifies without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk; a later notification must give reasons (Art. 33(1)), and where the risk is high, the data subjects must be informed (Art. 34). A contractual commitment to 24 or 48 hours with an emergency address, hotline and escalation protocol is a practice recommendation, not a statutory deadline; the duty to assist under Art. 28(3)(f) GDPR belongs in the same process. Details of the notification form are in the SaaS article, the controller's procedure under Data Breach Notification 72h.
9. Record of Processing Activities (Art. 30(2))
Alongside the controller's record under Art. 30(1), every processor maintains its own record of all categories of activities it carries out on behalf (Art. 30(2) GDPR), with the information under points (a) to (d); the description of the TOM under point (d) is to be included “where possible”. The exemption in Art. 30(5) for enterprises with fewer than 250 employees as a rule does not apply to IT service providers, because their processing on behalf is not merely occasional. How a record is structured is shown in the article Create GDPR Records of Processing.
10. Germany and Austria
Art. 28 GDPR applies directly in both countries. The national supplements differ:
- Germany: supervision of non-public bodies is exercised by the authorities competent under state law (§ 40(1) BDSG). A processor, too, designates a data protection officer where, as a rule, it constantly employs at least 20 persons in the automated processing of personal data (§ 38(1) BDSG).
- Austria: the supervisory authority is the Data Protection Authority (§ 18(1) DSG). Under § 6 DSG, data secrecy also applies to the processor and its employees; unless a statutory obligation already exists, the processor must bind them by contract and instruct them about the orders to transmit data.
Further differences for the contract itself are set out in the DPA article, section Germany and Austria.
11. Template Overview for IT Service Providers
A practice-ready template set of a processor regularly comprises the following documents. The list is a general practice list; the last column shows what of it is included in the GDPR Kit.
| Template | Purpose | In the GDPR Kit |
|---|---|---|
| DPA model contract with annexes 1 to 3 | Standard contract for all customers Art. 28(3) GDPR | yes: data processing agreement (template) |
| TOM description | Annex 2 with concrete status Art. 32 GDPR | yes: TOM documentation, TOM checklist for the audit, encryption and backup concept |
| Record as processor | Categories of processing per customer Art. 30(2) GDPR | no; the kit contains the controller's record of processing activities (RoPA) and a processor register for reviewing your own processors, not a record under Art. 30(2) |
| Data breach process with notification form | Notification to the customer and escalation Art. 33(2) GDPR | as a starting point: data breach response plan, 72h notification form and data breach register (from the controller's perspective); the duty to notify the customer under Art. 33(2) is governed by the data processing agreement (template) |
| Notification of sub-processors | Information with a contractual objection period (practice recommendation, e.g. 30 days) Art. 28(2) GDPR | no |
| Transfer impact assessment | Assessment of the third-country transfer Art. 46 GDPR | yes: transfer impact assessment, third-country transfer register, overview of adequacy decisions |
| Erasure concept after the end of the contract | Return or erasure with an evidence log Art. 28(3)(g) GDPR | as a starting point: erasure concept based on DIN 66398 |
| Checklist for customer audits | what is presented, what remains confidential Art. 28(3)(h) GDPR | no |
The GDPR Kit contains 69 editable templates (50 Word, 18 Excel, 1 PowerPoint) in 16 folders, including the modules processing on behalf, TOM, erasure concept, data breach and third-country transfer. There are three packages: Basic EUR 990 with 65 documents, Plus EUR 1,390 with a training pack and Complete EUR 1,690 with e-learning as HTML and SCORM 1.2/2004. All prices are net and one-off, with 12 months of legal-status updates, in the version for Germany or Austria, for businesses only. The templates are standardised documentation, not legal advice in the individual case.
Frequently asked questions
Do IT service providers always need a DPA?
Yes, where you process the customer's personal data on its behalf and on its instructions, for example in hosting, as a managed service provider, as a SaaS provider or in maintenance with data access (Art. 28(3) GDPR). Even storage or consultation counts as processing (Art. 4(2) GDPR). The pure sale of software that the customer operates itself, without you gaining access to data, is not a DPA case. Where you process customer data for your own purposes, you are, to that extent, a controller in your own right (Art. 4(7) GDPR; where the Regulation is infringed, Art. 28(10)). The DPA must be in writing; electronic form is sufficient (Art. 28(9) GDPR).
Do I need customer consent for every sub-processor?
The customer's prior written authorisation is always required, but not necessarily for each sub-processor individually. Art. 28(2) GDPR permits a specific or a general authorisation. Under a general authorisation, you inform the customer of every intended addition or replacement so that it can object. The GDPR sets no minimum period for this; you lay down the period in the contract, and 30 days is a widespread practice recommendation, not a statutory requirement. The same data protection obligations as in your own DPA must be imposed on the sub-processor (Art. 28(4) GDPR).
Which TOM are mandatory?
Art. 32 GDPR does not prescribe a fixed catalogue of measures but a level of security appropriate to the risk. It names pseudonymisation and encryption, the ongoing confidentiality, integrity, availability and resilience of the systems, the timely restoration after an incident and a process for regular testing (Art. 32(1)(a) to (d)). For IT service providers, the focus is typically on tenant separation, MFA for administrative access, encrypted remote maintenance, tested restoration from backups and the separation of test and production data. Contractually, you owe these measures to the customer under Art. 28(3)(c) GDPR; employees with access to data may process them only on instructions (Art. 32(4)).
What about a US cloud provider as sub-processor?
First, you need the customer's authorisation under Art. 28(2) GDPR. For the transfer itself, you check whether the US provider is included in the Data Privacy Framework List; only then does the adequacy decision (EU) 2023/1795 apply. The General Court of the EU dismissed the action for annulment of this decision on 3 September 2025 (T-553/23); the appeal C-703/25 P lodged against it has been pending before the Court of Justice since 31 October 2025 and had not been decided as at 17 August 2026. Where the provider is not listed, standard data protection clauses under Art. 46(2)(c) GDPR come into consideration, combined with an assessment of the legal situation in the recipient country under CJEU C-311/18 and, where necessary, supplementary measures such as encryption with your own key management. The transfer also belongs in your record under Art. 30(2)(c) GDPR.
How fast must I report a personal data breach?
As a processor, you notify a personal data breach to the controller without undue delay after becoming aware of it (Art. 33(2) GDPR). The provision sets no deadline in hours. The controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk; a later notification must give reasons (Art. 33(1) GDPR). A contractual commitment of 24 or 48 hours with a fixed notification channel is a practice recommendation, not a statutory deadline.
Must I keep a record of processing as a processor?
Yes, under Art. 30(2) GDPR, and in addition to the record of your own processing as a controller, for example for HR and accounting. The processor record assigns the categories of processing to each customer, for example hosting, maintenance or backup. It contains your contact details and those of each customer, including representatives and data protection officers (point (a)), the categories of processing (point (b)), where applicable third-country transfers (point (c)) and, where possible, a general description of the TOM under Art. 32(1) (point (d)). The exemption for fewer than 250 employees (Art. 30(5)) as a rule does not apply, because processing on behalf is not merely occasional. The record must be kept in writing or in electronic form and made available to the supervisory authority on request (Art. 30(3) and (4)).
Sources
- Regulation (EU) 2016/679 (GDPR), in particular Art. 4(2), (7) and (8), Art. 28, 30, 32, 33, 34, 45, 46 and 47, eur-lex.europa.eu
- Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework of 10 July 2023, Art. 1, 3 and 4, eur-lex.europa.eu
- General Court, judgment of 3 September 2025, T-553/23 (Latombe v Commission); appeal C-703/25 P of 31 October 2025, not decided as at 17 August 2026, eur-lex.europa.eu
- CJEU, judgment of 16 July 2020, C-311/18 (Schrems II), eur-lex.europa.eu
- European Data Protection Board (EDPB): Recommendations 01/2020 on measures that supplement transfer tools, version 2.0 of 18 June 2021, Use Case 1, para. 84, edpb.europa.eu
- German Federal Data Protection Act (BDSG), § 38(1) and § 40(1), gesetze-im-internet.de/bdsg_2018
- German Act on the Federal Office for Information Security (BSIG), § 28 and Annex 1, gesetze-im-internet.de/bsig_2025
- Austria: Data Protection Act (DSG), § 6 and § 18(1), ris.bka.gv.at