The data processing agreement: what is it and when do you need it?

You need a Data Processing Agreement as soon as you allow another party (a “processor”) to process personal data on your behalf — for example, a payroll administrator, a cloud service provider (SaaS), or a freelancer with access to your CRM. As the controller, you remain ultimately responsible, so you specify in the Data Processing Agreement what the processor may do with the data, for how long, and how it is secured.

Many entrepreneurs struggle with the data processing agreement and often think they do not need one. Usually, the opposite is true: processing occurs very quickly, and therefore a data processing agreement is required just as quickly.

Multiple parties often process your data

Anyone who processes personal data — for example, addresses in a CRM — bears a great deal of responsibility: the data must not be leaked and must not be retained longer than necessary. Usually, you are not the only one working with this data: you use external (cloud) services and exchange data, such as employee name, address, and bank details with your payroll administrator. This entails risks: a data breach, or a party that does not handle the data correctly.

It would be incorrect if the responsibility then lay entirely with that payroll administrator. Your staff trusts you and has the right to expect that you only share data with parties that comply with the GDPR, and that you make clear agreements regarding this. You record these agreements in a data processing agreement.

Controller and processor

The controller (in the example, the employer) determines the purpose and means and remains responsible at all times, even if they outsource the processing. The processor (the payroll administrator) processes the data on instruction. Because the controller remains liable, they must specify what the processor is and is not permitted to do. A data processing agreement is always mandatory if a processor processes personal data — even if that is a subsidiary.

When do I need one, and when don't I?

The determining factor is whether a third party processes the data:

• Required: for SaaS services (data goes to another person's server), or if a third party gains access to your server or system, such as a freelancer with access to your CRM.
• Not necessary: ​​for on-premise software where all data remains internal.

What is in it?

The content varies by situation — depending on the processor's tasks and the type of data — making the agreement difficult to draft yourself . Examples of agreements include: the payroll administrator may only use the data for payroll administration (not for their own marketing), how long they may retain it, and what security measures they take.

Both the processor and the controller are required to draw up a data processing agreement together. If they fail to do so, both are in violation and risk a fine; in the event of a data breach, the consequences and damage claims can be even greater.

Frequently Asked Questions

When do I need a data processing agreement?

As soon as a third party processes personal data on your behalf, such as a payroll administrator, cloud service provider, or freelancer with access to your system. Not applicable to fully internal (on-premise) processing.

Who is responsible for the data?

The controller remains ultimately responsible, even in the case of outsourcing. The processor acts on instruction and within the terms of the processor agreement.

What risks do I run without a data processing agreement?

Both the processor and the controller are in violation and may be fined. Moreover, in the event of a data breach, there is a risk of greater consequences and damage claims.

Have your data processing agreement drafted

The privacy lawyers at MKB Juristen draft a custom data processing agreement . View our expertise in privacy and data protection or schedule an intake meeting .