Data Processing Agreement (DPA): What It Must Include

A data processing agreement (DPA) is the written contract GDPR Article 28 requires whenever a processor handles personal data on behalf of a controller. It must describe the processing and include eight minimum terms: instructions, confidentiality, security, sub-processors, data subject rights, assistance, deletion and audits. Sharing between two independent controllers falls outside Article 28.

Key Takeaways

• A DPA is required for every controller and processor relationship, in both directions: with the vendors that process data for you, and with the customers you process data for.

• Article 28(3) sets the minimum content. A DPA can add terms, but it cannot leave out any required ones.

• A DPA does not cover international transfers on its own. Transfers outside the EU or UK need their own mechanism, such as an adequacy decision, the EU standard contractual clauses or the UK IDTA.

What Is a Data Processing Agreement?

A data processing agreement is the contract between a controller, which decides why and how personal data is processed, and a processor, which processes the data on the controller’s behalf.

Article 28(3) GDPR requires a processor’s processing to be governed by “a contract or other legal act” that binds the processor. Article 28(9) requires it to be in writing, including electronic form. A DPA can be a standalone document, a schedule to the main services agreement, or a set of online terms the customer accepts.

For a SaaS company, the DPA usually runs in two directions. Customers who put personal data into your product are controllers, and you are their processor, so they will ask you for a DPA. Your own vendors, such as hosting, email delivery, analytics or support tools, process data for you, so you need a DPA from each of them.

When Is a DPA Required?

A DPA is required whenever a controller uses a processor. The test is each party’s role, regardless of company size or contract value. Common examples include:

• a cloud hosting provider storing your customer database;

• a payroll provider processing your staff data;

• a customer support platform holding customer conversations;

• your SaaS product, when customers upload their own users’ or clients’ data.

Article 28(1) adds a duty that comes before the contract. A controller may use only processors that provide “sufficient guarantees” of appropriate technical and organisational measures. Checking a vendor before signing is part of the same obligation.

A DPA is not the right document when both parties are independent controllers, each deciding its own purposes. Article 28 does not apply to that relationship. Two companies that decide jointly why and how data is processed are joint controllers, and Article 26 requires an arrangement between them.

If a processor starts deciding the purposes and means of processing itself, Article 28(10) treats it as a controller for that processing. The roles depend on what each party does with the data.

What Must a DPA Include? The Article 28(3) Checklist

Article 28(3) has two parts. The first lists the processing details the contract must set out. The second lists the terms the processor must agree to.

Requirement	GDPR reference	In plain words
Details of the processing	Art. 28(3), first sentence	The subject matter and duration, the nature and purpose, the types of personal data, the categories of data subjects, and the controller’s obligations and rights
Documented instructions	Art. 28(3)(a)	The processor acts only on the controller’s written instructions, including on transfers outside the EU, unless the law requires otherwise. It tells the controller about any such legal requirement first, where the law allows
Confidentiality	Art. 28(3)(b)	Everyone the processor authorises to handle the data is bound by confidentiality, by contract or by law
Security	Art. 28(3)(c)	The processor takes the security measures required by Article 32
Sub-processors	Art. 28(3)(d)	The processor follows the rules in Article 28(2) and (4) before using another processor
Data subject rights	Art. 28(3)(e)	The processor helps the controller answer requests from individuals, such as access or erasure requests, as far as the nature of the processing allows
Assistance with obligations	Art. 28(3)(f)	The processor helps the controller with security, breach notification, DPIAs and prior consultation (Articles 32 to 36)
Deletion or return	Art. 28(3)(g)	At the end of the service, the processor deletes or returns the data at the controller’s choice, and deletes existing copies unless the law requires them to be kept
Audits and information	Art. 28(3)(h)	The processor provides the information needed to show compliance and allows for, and contributes to, audits and inspections by the controller or its auditor
Unlawful instructions	Art. 28(3), final subparagraph	The processor tells the controller immediately if it thinks an instruction breaks data protection law

The UK regulator, the ICO, describes these terms as the minimum in its guidance on what a controller-processor contract must include. The parties can add their own terms on top.

The European Commission has published standard contractual clauses for controller-processor contracts under Article 28(7), in Implementing Decision (EU) 2021/915 of 4 June 2021. Article 28(6) allows a DPA to be based on standard clauses in whole or in part.

How Do Sub-Processors Work Under Article 28(2) and (4)?

A sub-processor is a processor engaged by your processor. For a SaaS vendor, this often means its own hosting provider or support tooling.

Article 28(2) says a processor may not engage another processor without the controller’s prior written authorisation, which can be specific or general. Under a general authorisation, the processor must tell the controller about any intended addition or replacement of sub-processors and give the controller the chance to object.

In practice, most SaaS DPAs use a general authorisation with a published sub-processor list and a notice period for changes. Check how you will be notified and what happens if you object.

Article 28(4) covers the contract further down the chain. The processor must impose the same data protection obligations on each sub-processor by contract. If a sub-processor fails, the original processor remains fully liable to the controller for that sub-processor’s obligations.

Keep your own record up to date. Your record of processing activities should list the categories of recipients of personal data, which includes the processors you use.

Do DPAs Cover International Transfers?

Not by themselves. Article 28(3)(a) requires the DPA to state that the processor transfers data outside the EU only on the controller’s instructions. The transfer itself still needs a lawful mechanism under Chapter V of the GDPR.

• EU standard contractual clauses. The Commission adopted modernised SCCs for international transfers on 4 June 2021, in Implementing Decision (EU) 2021/914. They cover transfers from controllers or processors subject to the GDPR to controllers or processors outside the EU and EEA that are not subject to the GDPR. They are a separate set from the Article 28 clauses mentioned above.

• UK transfers. Under the UK GDPR, exporters can use the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs. According to the ICO, both came into force on 21 March 2022.

• EU-US Data Privacy Framework. The Commission adopted an adequacy decision for the United States on 10 July 2023. It covers commercial organisations that participate in the EU-US Data Privacy Framework. Check that your US vendor appears on the Data Privacy Framework List before relying on it.

Many vendor DPAs include the SCCs as an annex. Read which modules apply and check that the annexes describing the transfer are filled in.

How to Review a Vendor’s DPA: 8 Red Flags

When a vendor sends its standard DPA, check it against Article 28 before signing. These eight points come up most often:

• No description of the processing. If the DPA does not set out the subject matter, duration, purpose, types of data and categories of data subjects, it does not meet Article 28(3).

• The vendor can use your data for its own purposes. Wording that lets the vendor use customer data for its own product development, analytics or model training, outside your instructions, conflicts with Article 28(3)(a). Under Article 28(10), a processor that decides the purposes of processing becomes a controller.

• Sub-processors can change with no notice. Article 28(2) requires notice of intended changes and an opportunity to object under a general authorisation.

• No sub-processor list. Without one, you cannot check who handles your data or record it accurately.

• Audit rights removed. Article 28(3)(h) requires the processor to allow for and contribute to audits, including inspections. A clause that rules out any audit or inspection falls short.

• Vague breach support. The processor must assist with breach notification (Article 28(3)(f)) and notify the controller without undue delay after becoming aware of a breach (Article 33(2)). A DPA that is silent on how and when you will be told leaves you unable to plan your own response.

• Deletion is not your choice. Article 28(3)(g) gives the controller the choice between deletion and return at the end of the service. The ICO accepts that backups may not be deleted immediately, provided the data is rendered unusable and deleted in the next deletion cycle.

• No transfer mechanism. If the vendor or its sub-processors process data outside the EU or UK, the DPA or its annexes should name the mechanism that covers the transfer.

A GDPR audit of your vendor contracts can check every DPA you hold against the same list.

Does the UK GDPR Have the Same Rule?

Yes. Article 28 of the UK GDPR keeps the same structure and the same eight terms, with references to UK “domestic law” in place of EU and Member State law. The ICO’s guidance lists the same minimum terms and notes that it is under review following the Data (Use and Access) Act 2025.

Article 28(7), which lets the European Commission adopt clauses, is omitted from the UK text. Under the UK version of Article 28(8), the Information Commissioner may adopt standard contractual clauses for controller-processor contracts.

A company serving customers in both the EU and the UK can usually use one DPA that refers to both regimes, with the right transfer mechanism for each.

Conclusion

A DPA is short to describe and easy to get wrong. Check each vendor DPA against the Article 28(3) checklist, look for the eight red flags, confirm how transfers are covered, and keep your record of processing activities in step with your sub-processor lists.

GDPRLocal’s GDPR consultants review vendor DPAs, draft DPAs for SaaS companies to offer their customers, and check transfer arrangements. For ongoing oversight of processor contracts, see our data protection officer service.

Frequently Asked Questions

Do We Need a DPA With Our Customers as Well as Our Vendors?

Yes, where you process personal data on your customers’ behalf. In that relationship, the customer is the controller and your company is the processor, so Article 28 requires a contract with the same minimum terms.

Does a DPA Have to Be Signed on Paper?

No. Article 28(9) requires the contract to be in writing and says this includes electronic form. Many SaaS companies publish their DPA online and incorporate it into their terms.

Is a DPA Enough for Transfers to a US Vendor?

No. The DPA sets the processing terms. The transfer itself needs a mechanism, such as the EU-US Data Privacy Framework if the vendor is certified, or standard contractual clauses.

Can We Use the Commission’s Standard Clauses as Our DPA?

Yes. Article 28(6) allows a DPA to be based on standard contractual clauses in whole or in part, and the Commission adopted clauses for controller-processor contracts in Implementing Decision (EU) 2021/915.

Disclaimer: This blog post is for informational purposes only. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.