Data processing agreements in plain English
If you leave your apartment in a neighbor’s care while you’re on vacation, you agree on the ground rules beforehand: water the plants, yes; open the mail, no; don’t give the key to anyone else. A DPA does exactly that – only in writing and for data. It specifies what a service provider may and may not do with a company’s personal data.
Personal data is any data that can be linked to an individual, such as names, email addresses, customer numbers, or salary data. The EU General Data Protection Regulation (GDPR) distinguishes between two roles: the controller decides why and how data is processed. The processor processes it on the controller’s behalf and according to its instructions.
Typical processors include hosting and cloud providers, newsletter service providers, and external IT service providers with access to customer databases. Important: responsibility remains with the client. The client may only use service providers that can sufficiently demonstrate that they protect the data with appropriate technical and organizational measures.
What a DPA covers
Art. 28(3) GDPR specifies what a DPA must contain at a minimum:
- Subject matter, duration, nature, and purpose of the processing – in other words, what happens to the data and for how long.
- Type of data and categories of data subjects, such as customers’ contact details or employees’ HR data.
- Instructions: The service provider processes the data only on the client’s documented instructions.
- Confidentiality: Everyone with access is bound to confidentiality.
- Security measures: The service provider takes the technical and organizational measures (TOMs) required under Art. 32 GDPR.
- Sub-processors: The provider may engage other service providers only with the client’s prior authorization.
- Assistance, deletion, audits: The service provider helps with requests from data subjects and with data breaches, deletes or returns the data when the engagement ends, and allows audits, including inspections.
The contract must be in writing; an electronic format is expressly permitted. Templates from supervisory authorities or industry associations are often used as a starting point. The European Commission has also published standard contractual clauses for controller–processor relationships.
A practical example
A mid-sized online retailer wants its online shop tested for vulnerabilities. During the initial discussion, it becomes clear that the testing team might also reach areas containing real customer data during the test, such as orders and addresses.
The retailer’s data protection officer reviews the case and recommends a DPA. The retailer and the service provider sign one before testing begins. Among other things, it states that customer data will only be viewed to the extent necessary to demonstrate a vulnerability, and that copies will be deleted at the end of the project. For network diagrams, credentials, and the final report, both sides also sign a non-disclosure agreement (NDA). This protects the customer data as well as the retailer’s trade secrets.
Why does this matter for businesses?
If a required DPA is missing, that is a GDPR violation – usually on both sides. Data protection authorities can impose fines for it. Art. 83(4) GDPR provides for fines of up to €10 million or 2% of total worldwide annual revenue, whichever is higher. The actual amount depends on the individual case.
The practical benefits are at least as important: a good DPA creates clarity about who may do what with which data. In the event of a data breach, it’s immediately clear who has to inform whom. And you can demonstrate to customers, auditors, and authorities that you have selected your service providers carefully and bound them contractually.
DPAs also play a role in IT security services. Whether a penetration test or a phishing simulation counts as processing on behalf of a controller depends on the individual case – above all, on whether the testing team gains access to personal data. An NDA doesn’t replace a DPA but complements it: the NDA protects confidential business information, while the DPA governs the handling of personal data.
What businesses should do now
- Take stock of your service providers: List all external partners who work with your company’s personal data – from hosting to remote maintenance.
- Review contracts: Is there a current DPA for each of these service providers that covers the minimum content under Art. 28 GDPR?
- Request TOMs: Ask the service provider to describe its security measures, and check whether they match the risk.
- Keep an eye on sub-processors: Ask to be told which other service providers are involved and how you’ll be informed of changes.
- Involve your data protection officer: Clarify borderline cases, such as security tests, early on with your company’s data protection officer.
- Cover confidentiality as well: For network diagrams, credentials, or test results, an NDA is also advisable.
Note: This article is for general information only and does not constitute legal advice.
How Rootsektor can help
We clarify with you during scoping whether a penetration test or security assessment will involve personal data – so you can decide in good time whether a DPA is needed. On request, we sign a non-disclosure agreement in advance. Have questions about a planned project? Contact us or request a quote directly via our Pentest Quote page.