Data Processing Agreement: what it is and how to write it

What is a data processing agreement?

It is the agreement that article 28 of the GDPR requires to be signed between the data controller (who decides on the data, usually your company) and the data processor (a third party that processes that data to provide you with a service: your hosting, your email tool, your accountant, an agency…). Without this agreement, such a transfer of data would be unlawful.

When do I need it?

Whenever a provider accesses the personal data of your clients or users in order to provide you with a service. Common examples: the hosting provider where your website is hosted, the email marketing platform, the CRM, the firm that handles your payroll or invoicing, or an agency that manages your campaigns.

What must it include? (art. 28.3 GDPR)

• Subject matter, duration, nature and purpose of the processing.
• Type of personal data and categories of data subjects.
• Obligations of the processor: process only on instructions, confidentiality, security (art. 32), assistance and breach notification.
• Rules on sub-processing.
• Return or deletion of the data once the processing ends.