Data Processing Agreements: What They Are and When You Need One

Date: 21/10/2026

The paperwork almost every business is missing

If your business uses email marketing software, cloud storage, a booking system, an accounting platform, or most SaaS tools that handle customer data, you’re relying on someone else to process personal data on your behalf. GDPR has a specific requirement for that relationship, and it’s an often overlooked piece of paperwork in small business compliance: the Data Processing Agreement, or DPA.

Controller and processor: the roles that matter

GDPR draws a clear line between two roles. You, deciding why and how customer data gets processed, are the controller. The tool you’re using — a newsletter platform sending your emails, a cloud provider storing your files, a booking platform holding your customer list — is the processor, acting on your instructions. Article 28(3) requires that this relationship be governed by a contract (or other legal act) that binds the processor to you, and Article 28(9) requires it to be in writing — which can be electronic. That contract is the DPA.

You also have a duty before signing anything: only use processors that provide sufficient guarantees that they will protect the data properly (Article 28(1)).

What a DPA actually has to cover

A valid DPA under Article 28(3) must set out the subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of people involved, and your rights and obligations as controller. It must also commit the processor to:

Act only on your documented instructions — including on international transfers — and tell you straight away if an instruction would breach GDPR.
Ensure that everyone handling the data is bound by confidentiality.
Take appropriate security measures (Article 32).
Use sub-processors only with your prior written authorisation — specific or general (in which case they must tell you about changes so you can object) — pass the same obligations down the chain, and remain fully liable to you for them (Article 28(2) and (4)).
Help you respond to data subject rights requests — see What Are Your Customers’ Rights Under GDPR?
Help you meet your security, breach notification and DPIA obligations — see What to Do When You Discover a Data Breach
At your choice, delete or return all the data at the end of the service and delete existing copies, unless EU or Member State law requires them to be kept.
Give you the information needed to demonstrate compliance, and allow for audits and inspections.

Do you need to write one yourself?

Usually not. Most established SaaS providers — major email marketing, payment, cloud and booking platforms — already publish a standard DPA, often as a “Data Processing Addendum” linked from their legal or privacy pages, or built into their terms of service. Your job is to find it, review it, and make sure it has actually been accepted for your account — not to draft one from scratch for every tool you use. Do still check it against the Article 28(3) list above rather than assuming it is complete.

Where it gets more hands-on is with smaller or local vendors who may not have a ready-made agreement. In that case, you (or whoever handles your contracts) need to put one in place before you start sharing personal data with them.

A simple audit to run

List every third-party tool or vendor that touches personal data — CRM, email marketing, booking, payments, cloud storage, even a freelance bookkeeper with system access (depending on the arrangement, some providers act as controllers in their own right).
For each one, check whether a DPA exists — most major providers link theirs from their trust, legal or privacy pages.
Confirm it has actually been accepted or signed, not just theoretically available.
For smaller vendors without one, ask them to sign a DPA before sharing any data.
Note where the data is stored and accessed from — if outside the EU/EEA, check the transfer is covered — for example by an adequacy decision (such as the EU-US Data Privacy Framework, for certified US companies) or the European Commission’s standard contractual clauses.

Why this matters beyond paperwork

Using a processor without an Article 28 contract is a GDPR infringement in its own right — one that can attract fines of up to €10 million or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)(a)). The infringement exists however good the processor’s security is, though the size of any fine depends on the circumstances (Article 83(2)). The DPA is also the document that decides what happens when something goes wrong: a processor must notify you of a breach without undue delay (Article 33(2)), and a clear contractual commitment on how and how fast is what gives you a fighting chance of meeting your own 72-hour notification deadline.

Want a second pair of eyes on your vendor contracts? Let’s Talk GDPR.