Data processing agreement (DPA)

In short: If a service provider processes personal data on behalf of and on instruction from you (for example hosting, email sending), you need a data processing agreement (DPA).

In more detail: The controller remains responsible for the data; the processor acts only on instruction. The contract (Art. 28 GDPR) regulates subject matter, duration, type of data, duties, audit rights, sub-processors and technical measures.

In Depth

• Typical processors: hosters, cloud providers, newsletter service, payment processors (partly independently responsible), support software, analytics tools.
• Sub-processors: must be named and approved.
• Third countries: For servers outside the EU, additional rules apply (data transfers to third countries).
• Technical and organisational measures (TOMs): access control, encryption, backup, logging.
• In practice: Most providers supply the DPA as a download or click-through.
• Also required: entry in the record of processing activities.

See also: GDPR: principles and legal bases, Record of processing activities