MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
If you process personal data only incidentally and to a limited extent in the course of an assignment, a comprehensive data processing agreement is not always necessary. Often, a privacy clause in your general terms and conditions suffices. However, in a genuine data processor relationship, a data processing agreement remains mandatory.
Do you process personal data?
If you work for a client, you often process personal data — even if the assignment has nothing to do with it substantively, such as employee contact details. As soon as this happens, GDPR rules apply, and you must make agreements regarding that processing.
When is a privacy clause sufficient?
For incidental, limited processing activities that do not constitute the core of the assignment, a full data processing agreement is often too burdensome. In such cases, a clear privacy clause in your general terms and conditions may suffice: in it, you stipulate how you handle the data, that you secure it, and do not use it for your own purposes.
When is a data processing agreement mandatory?
If you systematically process personal data on behalf of and according to the instructions of another party — in which case you are a 'processor' — the GDPR mandates a data processing agreement (Article 28 GDPR). A privacy clause is not sufficient in this case. Think of IT, hosting, or administrative service providers.
Determine your role
The key is your role: are you a controller, a processor, or do you process data only incidentally? That role determines whether a privacy clause suffices or whether a data processing agreement is necessary. In case of doubt, a brief legal review is advisable.
Frequently Asked Questions
Do I always need a data processing agreement?
No. For incidental, limited processing, a privacy clause in your terms and conditions may suffice. However, in the case of a genuine processor relationship, a data processing agreement is mandatory (Article 28 GDPR).
What is stated in a privacy clause?
Agreements on how you handle the data: security, purpose limitation, confidentiality, and that you do not use it for your own purposes.
How do I know which one I need?
That depends on your role and the nature of the processing. If in doubt, have this briefly checked.
Want to properly arrange your privacy agreements?
Our legal experts draft privacy clauses, data processing agreements , or general terms and conditions . View our privacyteam or schedule a free consultation.
