DPA (Data Processing Agreement)

A mandatory contract under Article 28 GDPR where processing is carried out on behalf of a controller

26 April 2026 · Category: GDPR · Compliance-Kit

TL;DR

A Data Processing Agreement (DPA) is a contract required under Article 28(3) GDPR whenever a controller has personal data processed by a service provider. It governs 8 mandatory elements: subject matter, duration, nature and purpose, categories of data, obligations and rights, as well as confidentiality, sub-processing, assistance with data subject rights and technical and organisational measures.

What is a DPA (Data Processing Agreement)?

A DPA is mandatory under Article 28(3) GDPR for all processing carried out on behalf of a controller. Such processing exists where an external service provider processes personal data on the controller's instructions — typical examples: IT hosting, cloud services, newsletter dispatch, outsourced payroll.

The BayLDA clarification of 2024 established that tax advisers are not processors but controllers in their own right — no DPA is required.

Practical example

A mechanical engineering firm with 30 staff concludes DPAs with:

Microsoft (M365 hosting)
Mailchimp (newsletter, third-country guarantee DPF)
HubSpot (CRM)
an external payroll accountant (where qualifying as a processor)
an IT systems house (maintenance with access to data)

Frequently asked questions

Is the provider's standard DPA enough?

Often yes, but check: third-country transfer clauses, the list of sub-processors, return of data at the end of the contract. Your own amendments are permitted under Article 28.

Is a DPA needed with an IT maintenance provider?

Yes, as soon as access to data is possible during maintenance. Even for read-only access, conclude a DPA to be safe.

Who vets the processors?

The controller bears the duty to select and monitor them (Article 28(1)). In practice: an annual review of the processor list + a risk-based review of the technical and organisational measures.