What is a data processing agreement? Explanation and use

What is a data processing agreement? It is the written agreement between an organization that has personal data processed and the party that performs that work for it. The term originates from the old Personal Data Protection Act (Wbp), which referred to a “processor.” Since May 25, 2018, the GDPR has been in effect, and the same contract is officially called a data processing agreement. In terms of content, it concerns the same agreement: who is allowed to do what with the data, how it is secured, and what happens if things go wrong. The mandatory content is set out in Article 28 of the GDPR. Below is an explanation, practical application, and the points where things often go wrong for SMEs.

The short answer

• What: a mandatory contract between the controller and the processor regarding the processing of personal data.
• Name: “processor agreement” is the old Wbp term; under the GDPR, it is called a processor agreement.
• Legal basis: Article 28 GDPR, with mandatory content in paragraph 3, sub a to h.
• When: as soon as an external party processes personal data on your behalf, such as a hosting provider, payroll processor, or CRM supplier.
• Form: in writing, electronically is also permitted (Article 28 paragraph 9 GDPR).
• Risk: if the agreement is missing, both parties violate the GDPR and the Dutch Data Protection Authority can take enforcement action.

What exactly is a data processing agreement?

A data processing agreement stipulates that an external party processes personal data exclusively according to your instructions and not for its own purposes. Think of an accounting firm that handles your payroll, an IT company that manages your servers, or a software vendor that stores your customer data in the cloud. Without such an agreement, no one knows who is responsible for what if data is leaked.

The agreement is not a formality. The GDPR makes it mandatory and links concrete obligations to it: subject to instructions, confidentiality, security, return or destruction upon expiration, and permission for inspection. In the event of a violation of Article 28, the Dutch Data Protection Authority may impose a fine of up to 10 million euros or 2 percent of the worldwide annual turnover (Article 83(4) GDPR).

Data Processing Agreement or Processor Agreement?

This difference causes a lot of confusion, so let's clarify. Under the Wbp, the parties were called “controller” and “processor,” and the contract was therefore a processor agreement. The GDPR has replaced those terms with “controller” and “processor.” Therefore, since 2018, the correct term is processor agreement, also known as a data processing agreement or DPA.

Many entrepreneurs still search using the old term, and that is not a problem. As long as the document complies with Article 28 of the GDPR in terms of content, the name on the first page is not legally decisive. Nevertheless, it is wise to call new contracts a “processor agreement.” A document that still uses the old Wbp terminology and the old article references is usually also outdated in content and lacks elements prescribed by the GDPR.

Controller or processor?

Before you sign anything, you must know what role you have. Article 4 of the GDPR defines it as follows:

• Controller (Article 4, sub 7): the party that determines the purpose and means of the processing. You decide which customer data you collect and why.
• Processor (Article 4, sub 8): the party that processes the data on behalf of the controller, without control over the purposes and means.

The role follows from the facts, not from the label in the contract. If a supplier determines the purpose and means himself, he qualifies as a controller for that processing (Article 28, paragraph 10 GDPR), and a data processing agreement is the wrong instrument. If two parties determine the purpose together, they are joint controllers, and a different arrangement follows from Article 26 GDPR. For example, an accountant who has statutory retention obligations himself is not a processor for that part.

What is it legally required to contain?

Article 28(3) of the GDPR first prescribes a description of the subject matter and duration of the processing, the nature and purpose, the type of personal data and the categories of data subjects. In addition, it must contain the following eight obligations of the processor:

1. Sub a: process only on documented instructions from the controller, including in the case of transfer to a third country.
2. Sub b: ensure that persons with access to the data are bound by an obligation of confidentiality.
3. Sub c: take appropriate security measures pursuant to Article 32 GDPR.
4. Sub d: comply with the conditions for engaging sub-processors (Article 28, paragraphs 2 and 4).
5. Sub e: providing assistance with requests from data subjects exercising their rights.
6. Sub f: providing assistance with security, data breaches and data protection impact assessments (Articles 32 to 36).
7. Sub g: at the end of the service, delete or return all data, at the option of the controller, and delete copies unless retention is required by law.
8. Sub h: make all information available to demonstrate compliance and enable audits.

Subprocessors, transfer and data breaches

Three topics deserve extra attention, because they are often insufficiently covered in standard contracts.

Sub-processors. A processor may only engage another party with prior specific or general written consent (Article 28 paragraph 2 GDPR). In the case of general consent, the processor must inform you of changes so that you can object. The sub-processor is subject to the same obligations, and the primary processor remains fully liable to you (Article 28 paragraph 4).

Transfer outside the EEA. If the servers or the helpdesk are located outside the European Economic Area, Chapter V of the GDPR applies. Transfer is permitted on the basis of an adequacy decision (Article 45, for example the EU-US Data Privacy Framework for certified US parties), on the basis of appropriate safeguards such as the European Commission's Standard Contractual Clauses (Article 46), or via one of the limited exceptions of Article 49. Record where the data is located and which legal basis applies.

Data breaches and rights of data subjects. The processor must report a breach to the controller without delay (Article 33(2) GDPR). You then have 72 hours to assess whether notification to the Data Protection Authority is necessary. Therefore, agree on a specific timeframe, for example 24 hours, and record what information the processor includes. The same applies to requests for access, correction, or deletion: the processor must assist you with this and forward the request instead of responding themselves.

Practical example

An installation company with fourteen employees uses a cloud package for planning and time registration. The supplier processes the names, addresses, and telephone numbers of customers and technicians within it. The company signs the supplier's standard DPA without reading it. In the event of a malfunction, it turns out that support is being operated from a country outside the EEA, even though the document states nothing about this. After inquiries, the supplier subsequently provides a list of subcontractors and the standard contractual clauses. A brief prior check would have prevented that dispute.

Honest recommendation

You by no means always need a lawyer. If you work with a standard supplier that offers an up-to-date data processing agreement, includes a list of sub-processors and a notification period for data breaches, and the data remains within the EEA, then you can perfectly well check and sign it yourself. Go through the eight points of Article 28(3) and check whether the appendices correspond to what you are actually purchasing.

Do seek supervision regarding special personal data such as health or criminal data, large data volumes, transfers outside the EEA, when in doubt about your role (processor or joint controller), and when you are a processor yourself and wish to present your own model to clients. In those cases, the text determines who bears the risk if something goes wrong.

Arrange it or read on: data processing agreement, draft it yourself via draft data processing agreement and outsource via have data processing agreement drafted.

Frequently Asked Questions