Drafting a Data Processing Agreement: everything you need to know as an entrepreneur

Did you know that the number of data breach notifications in Europe has risen by 22 percent by 2025 to an average of more than 400 reports per day? For you as an entrepreneur, this trend means that drafting a data processing agreement is not an administrative burden, but an essential risk management tool that safeguards the continuity of your business. With stricter enforcement by the Dutch Data Protection Authority, a watertight document has simply become indispensable to protect your company.

It is understandable that the fear of fines, which can amount to up to 20 million euros, weighs heavily on your shoulders. The uncertainty regarding who is responsible for submitting the agreement and the complex legal jargon often make the subject matter unnecessarily burdensome and confusing. In this article, you will discover exactly when an agreement is legally required and how to structure it correctly from a legal perspective to mitigate risks associated with data breaches. We guide you step-by-step through the legal GDPR obligations, so that you can once again collaborate with your business partners with peace of mind and a professional image.

What is a data processing agreement and why is drafting one mandatory?

A data processing agreement is a formal contract between a data controller and a data processor. In plain language, this means making agreements with an external party that processes personal data on your behalf. Examples include a cloud provider, a payroll administrator, or a marketing agency. Previously, we called this document a data processor agreement, but since the introduction of the GDPR, the term has changed and the requirements have become significantly stricter. The purpose of this document is crystal clear: you establish how data security is ensured and what happens if something unexpectedly goes wrong.

The legal basis for this contract can be found in Article 28 of the GDPR. In the Netherlands, this is further supported by the GDPR Implementation Act, which establishes the framework for the protection of privacy rights. The law states that a verbal agreement or a quick confirmation by email simply does not suffice. You are required to record the agreements in writing or digitally. Without a signed document, you are legally vulnerable and do not comply with the accountability obligation prescribed by privacy legislation.

The role of the GDPR in modern business

Privacy legislation is no longer a distant concern for the average SME entrepreneur. The Dutch Data Protection Authority (AP) is scrutinizing the way companies manage their supply chain. If you share personal data with a third party without a formal contract, you risk substantial sanctions. Drawing up a data processing agreement is therefore a necessary step to avoid fines that can run into millions of euros. Moreover, a signed contract serves as essential evidence when the regulator visits you for an inspection.

The difference between a privacy statement and a data processing agreement

Many entrepreneurs confuse these two documents, even though they serve completely different functions. A privacy statement is a unilateral document that you publish on your website. It is intended to inform your customers and visitors about what you do with their data. A data processing agreement, on the other hand, is a bilateral agreement between business partners. While the statement focuses on the relationship with the data subject, the agreement focuses on arrangements with your suppliers and subcontractors. For full compliance, you need both documents; they complement each other and cover different legal risks. Do you want to get to work on your legal foundation immediately? Then drafting a data processing agreement through an expert partner is the most efficient route to certainty.

When do you need to draft a data processing agreement?

The need for a contract arises the moment you outsource the processing of personal data to another party. It is a misconception that this only applies to large tech companies. In practice, almost every SME entrepreneur faces this. The core question you must ask yourself is: “Does this external party process data on my behalf and under my instructions?” If the answer is yes, then drafting a data processing agreement is legally required. Officially, the responsibility for initiating this agreement lies with the data controller, although we often see professional processors submitting a proposal themselves.

However, there are situations where you do not need an agreement. This applies particularly to collaborations with independent professionals. Examples include a lawyer, a notary, or an occupational physician. These professionals determine how they handle data based on their own professional rules and legal obligations. They are therefore usually regarded as an independent controller rather than a processor. It is crucial to be clear on this distinction to avoid unnecessary administrative burden and legal errors.

Practical examples for SMEs

In daily business operations, there are three scenarios that occur most frequently. First, the IT administrator or cloud provider that manages your backups or hosts your email. Because they have access to all your business data, a contract is indispensable. Many tech companies use the Standard Data Processing Agreement from NLdigital to streamline these arrangements. Second, the administration office that handles your payroll; they process sensitive information regarding your personnel. Finally, marketing tools for newsletters also fall under this obligation. As soon as you upload a list of email addresses to an external platform, you are required to contractually establish the privacy rules.

Processor versus controller

Determining the correct role is the foundation of any good agreement. The data controller is the party that determines the purpose and means of data processing. You therefore decide what happens to the data and why. The processor then carries this out solely for you. Sometimes, two parties jointly determine how the data is used. In that case, we speak of joint responsibility, which entails different contractual requirements. Are you unsure about your specific division of roles? On our contracts page , you will find support to define these roles legally correctly, so that you know exactly which obligations rest on your shoulders. After all, an incorrect role definition can lead to gaps in your liability, which is precisely what you want to avoid.

What are the minimum requirements for a data processing agreement?

Drafting a data processing agreement is not simply a matter of putting a few general rules on paper. Article 28 of the GDPR serves as a mandatory checklist in this regard, leaving no room for interpretation. You must record at a minimum the subject matter, duration, nature, and purpose of the processing. It is essential to specify exactly which personal data is being processed. Does it only concern names and email addresses for a newsletter? Or does the party also process sensitive information such as national identification numbers, financial data, or medical data? Do not forget to name the categories of data subjects, such as your own employees, website visitors, or your entire customer base. The more specifically you describe this, the smaller the chance of disputes later on.

Security forms the heart of the agreement. You make concrete agreements regarding the technical and organizational measures that the processor will take to protect the data against loss or unlawful processing. This includes matters such as encryption, access control with two-factor authentication, and physical security of servers. In addition, the processor must guarantee that all persons processing the data under its authority have signed a strict confidentiality obligation. This applies not only to permanent staff but also to temporary staff or external consultants who have access to the systems.

Data breaches and the reporting obligation

In the event of an incident, every second counts. In the agreement, you specify how quickly the processor must inform you after the discovery of a data breach. The law refers to notification without undue delay. Usually, this is translated in the contract into a strict deadline of 24 or 48 hours. After all, as the data controller, you are the one who must submit the notification to the Dutch Data Protection Authority, and for this, you need all the facts in a timely manner. A clear procedure in your contract prevents panic and errors when things really go wrong.

Subprocessors and audits

May your supplier, in turn, engage other parties to execute the assignment? This is only permitted if you provide prior written consent. These sub-processors must comply with exactly the same strict privacy requirements as your direct partner. To ensure that these agreements are not empty words, the right to audit is a powerful tool. This allows you to retain the ability to conduct an inspection or send an independent expert to verify whether the security and processes still comply with the GDPR. Finally, you must clearly document what happens to the data when the collaboration ends. Will the data be permanently destroyed, or will it be returned to you in a standard format? Without these agreements, you will be left with a significant legal risk after the contract expires. For professional support in drafting a data processing agreement, you can make use of our GDPR/Privacy documentation services.

The risks of a standard processor agreement model

You can find countless free templates for privacy contracts online. While it is tempting to quickly download a document, this poses a significant danger to your business operations. Drafting a data processing agreement is more than just ticking a legal box; it is a tool for managing your business risks. Standard templates are often too general or fail to take into account the specific data flows within your organization. Particularly with large software vendors, you often see restrictive contracts written entirely to their advantage, leaving you as an entrepreneur with a substantial residual risk.

Another major risk is unlimited liability that may unknowingly remain with you. While fines from the Dutch Data Protection Authority (AP) can amount to up to 20 million euros or 4 percent of global annual turnover, many processors try to limit their own compensation to a fraction of that amount. Without customization or a thorough review, you are signing up for a risk that directly jeopardizes the financial health of your company. A ContractCheck™ is therefore essential to determine whether the written agreement aligns with your practical interests. In addition to your data processing agreements, it is also wise to create a register of processing activities so that you always have a complete overview of all data flows within your organization.

Dividing liability and fines

Can you simply recover a fine from the Dutch Data Protection Authority (AP) from your processor? In practice, this proves to be legally extremely complex. After all, the regulator imposes the sanction on the party violating the law, and that is often you as the party ultimately responsible. It is therefore crucial to include a realistic liability limit in the contract that is proportionate to the potential risk. MKB Juristen assists you in clarifying these clauses, ensuring you are not unnecessarily financially vulnerable in the event of a data breach caused by an external party.

Prevent unworkable provisions

Sometimes, standard contracts contain provisions that hinder rather than help your daily operations. Consider excessively strict audit requirements that would require you to conduct monthly on-site inspections, which is unworkable for both you and the processor. Unclear deadlines for reporting incidents also frequently cause friction and panic. A good agreement must align seamlessly with your general terms and conditions to prevent legal inconsistencies. Do you want to be sure that your documentation truly protects you? Let our experts perform a ContractCheck™ for immediate certainty.

Professional help with drafting your GDPR documentation

Many entrepreneurs can no longer see the wood for the trees when it comes to privacy legislation. Drafting a data processing agreement is an important step, but it is only part of a larger whole. At MKB Juristen, we believe in an integrated approach. There is little point in having your external contracts in order if your internal processing register is missing or if your privacy statement contains outdated information. We unburden you by offering a coherent package that covers your entire business operations. This allows you to create a legal foundation that not only prevents fines but also inspires confidence in your customers and partners.

Our legal experts speak the language of the entrepreneur. We avoid dusty jargon and focus on practical solutions that enhance your operational efficiency. Whether you offer a complex SaaS solution or are a local service provider, we translate the stringent requirements of the GDPR into understandable agreements. In 2026, the Dutch Data Protection Authority will implement a stricter enforcement policy, focusing on the entire data processing chain. By immediately getting started with solid documentation, you prevent having to spend valuable time later correcting errors or engaging in discussions regarding liability in the event of data breaches. For a complete overview of all obligations applicable to your business, our practical guide on GDPR compliance for SMEs a clear starting point.

The ContractCheck™ for your privacy contracts

Do you already have agreements in place that have been provided by suppliers? It is risky to sign these without a critical eye. Often, these documents are drafted unilaterally to provide maximum protection to the supplier, while the risks remain with you as the data controller. With our ContractCheck™, we have your current agreements checked for GDPR compliance. We look specifically at liability limits, notification periods, and audit rights. This aligns seamlessly with the importance of customization in your other communications; read more about this in our article on having a privacy statement drafted.

The legal starter package for new businesses

For new SMEs, we have made the process even simpler. Instead of gathering separate documents, our starter package ensures everything is properly arranged in one go. This includes not only your general terms and conditions but also tailor-made data processing agreements that perfectly match the tools and partners you will be working with. This way, you start your business with the assurance that you meet all legal requirements without having to become a privacy expert yourself. Would you like to know where you currently stand? Contact us for a GDPR scan of your company and discover how we can support you in drafting a watertight data processing agreement.

Ensure a watertight legal foundation

Drafting a data processing agreement is much more than simply complying with the GDPR. It is a strategic choice to protect your business against unforeseen data breaches and disproportionate fines. We have observed that standard templates often fall short regarding the allocation of liability and that a clear definition of roles forms the basis for any secure collaboration. By getting your privacy contracts in order now, you avoid legal headaches and make a professional impression on your business partners.

At MKB Juristen, we understand that you would rather focus on your business than delve into complex legal texts. With over 15 years of experience in business contracts, we offer you the certainty you need. We work with transparent rates and speak plainly, so you know exactly where you stand. Have your Data Processing Agreement drafted by the experts at MKB Juristen and experience the peace of mind of fully GDPR-compliant business operations. Together, we build a secure future for your business.

Frequently asked questions about the data processing agreement

Is a data processing agreement mandatory for every self-employed professional?

Yes, even as a self-employed professional, you are required to have this document as soon as you process personal data on behalf of another or outsource this to an external party. The law makes no distinction based on the size of your business. It concerns purely the act of processing data, such as hosting a website or managing a client list for a client.

What happens if I do not have a data processing agreement in the event of a data breach?

In the event of a data breach without a valid contract, you risk an immediate fine from the Dutch Data Protection Authority and full liability for all consequential damages. The regulator views the absence of an agreement as a serious failure to meet your accountability obligations under the GDPR. Moreover, you are in a very weak legal position if you wish to recover damages from the party where the error actually occurred.

Who must provide the data processing agreement, the customer or the supplier?

The data controller must officially take the initiative, but in practice, suppliers often offer their own standard proposal. It is crucial that you have this proposal critically reviewed before signing. Ultimately, both parties bear the legal responsibility to ensure that a signed and correct copy is present in the records.

Do I need to enter into a data processing agreement with my accountant?

In most cases, a contract with your accountant is not necessary, as they are generally considered independent data controllers. This is because accountants determine for themselves how they process data based on their own professional rules and legal obligations. However, this may change if you engage the accountant solely for purely executive tasks, such as payroll administration; in that case, an agreement is required.

Is a processor agreement the same as a data processing agreement?

Yes, a data processing agreement is the modern successor to the old data processor agreement from the time of the Personal Data Protection Act. However, since the introduction of the GDPR in 2018, the requirements for this document have become much stricter and more extensive. Therefore, an old data processing contract almost never complies with current legislation and must be updated.

Can I use a standard model from the internet for my business?

You can use a model, but drafting a data processing agreement using a free template entails significant risks regarding your liability. Every company has unique data flows and specific risk profiles that a general model cannot cover. Customization ensures that you do not unintentionally sign for damage claims or fines that you could have actually limited with the right clauses.

What about data processing agreements outside the EU (such as the US)?

For data transfers to countries outside the European Union, particularly strict rules and additional contractual provisions apply. For American companies, you can use the EU-US Data Privacy Framework if they are officially certified. In other cases, you must use Standard Contractual Clauses (SCCs) to legally safeguard the privacy of data subjects in accordance with European standards.

Does a data processing agreement need to be signed physically?

No, a physical signature with a pen on paper is no longer necessary for the legal validity of the contract. A digital signature is just as valuable, provided it is reliable and traceable to the correct authorized signatory. This makes the process of drafting and signing a data processing agreement significantly faster and more efficient in modern business practice.