Data processing agreement: what should it contain? (Article 28 GDPR, checklist)

A data processing agreement is a written agreement between an organisation and a party that processes personal data on its behalf. Article 28(3) of the GDPR makes that agreement mandatory and lists what it must contain. According to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) , both parties are in breach if the agreement is missing.

Whether you need a data processing agreement depends on the roles. If you are unsure, read processor or controller first. This page gives the complete checklist, example wording and the points that an ISO 27701 auditor checks.

When do you need a data processing agreement?

You need a data processing agreement as soon as an external party processes personal data for you and follows your instructions. That party does not decide the purpose itself. A few recognisable situations:

Situation	Data processing agreement needed?
Your payroll administration runs through a payroll provider	Yes, the provider processes on your behalf
Your CRM or accounting package runs in the cloud	Yes, the software supplier is a processor
Your IT administrator has access to your mailbox and files	Yes
You file payroll returns with the Dutch Tax Authority (Belastingdienst)	No, it receives the data for its own statutory task
You work with another healthcare provider on the same patient	No, you are each responsible yourselves

The label in the contract does not decide. The AP looks at the actual situation: who decides why and how the data is processed? If the agreement states that the other party is the controller, but you determine purpose and means, then you are the controller.

Checklist: what must a data processing agreement contain?

The GDPR first requires a general description of the processing. After that come eight mandatory commitments (Article 28(3), points (a) to (h)). Use this table as a checklist for every agreement you sign or draft.

Element	What you record	Example wording
Description	Subject, duration, nature and purpose, types of data, categories of data subjects	”The processor hosts the customer portal. Data: names, addresses, email addresses and customers’ order history.”
a. Instructions	The processor acts only on documented instructions, including for transfers outside the EU	”The processor uses the data solely for the service described in annex 1.”
b. Confidentiality	The processor’s staff are bound by confidentiality	”Everyone with access has signed a confidentiality statement.”
c. Security	Appropriate measures under Article 32	”The measures are set out in annex 2 and reviewed annually.”
d. Sub-processors	Only with prior authorisation, and the same obligations are passed on	”The processor notifies you of a new sub-processor 30 days in advance. The client may object.”
e. Rights of data subjects	The processor helps with access, correction and erasure	”The processor forwards requests within 2 working days.”
f. Other obligations	Help with security, data breaches, DPIAs and prior consultation	”The processor reports a data breach within 24 hours of discovery.”
g. End of service	Return or delete the data, including copies	”All data is deleted within 30 days of the end of the contract, with a written declaration.”
h. Audits	Make information available and cooperate with audits	”The client may have an audit carried out once a year, or request a recent ISO certificate.”

The deadlines in the example wording are choices, not legal requirements. For data breaches, the law only requires the processor to notify “without undue delay”. A specific deadline makes the agreement testable.

As controller, you have only 72 hours to report a data breach to the AP yourself. If you agree “within 72 hours” with the processor, you have no time left yourself. Choose a shorter deadline. You can read more about this on reporting a data breach.

What to check in a supplier’s data processing agreement

Large suppliers send their own data processing agreement, often titled “data processing agreement” or DPA. You can rarely change it. So focus on these five points.

Location of the data. Are the servers and support teams inside the EEA? If not, on what basis is the transfer arranged?
List of sub-processors. Is it public, and are you informed of changes?
Breach notification period. Is it specific, and short enough for your 72 hours?
Exit. Do you get your data back in a usable format before it is erased?
Liability. Standard agreements often limit liability heavily. Weigh that against the risk.

If you cannot negotiate, record in your own supplier management which risks you accept. An auditor will want to see that too.

Example: data processing agreement with a payroll provider

Fictional example. A webshop with 25 employees outsources its payroll administration. The payroll provider sends a standard agreement. The privacy manager goes through the checklist.

Checkpoint	Finding	Action
Description	Complete, including social security number and bank account number	None
Sub-processors	Hosting partner named, changes “are published on the website”	Ask for active notification by email
Data breaches	”Without undue delay”	Ask for 24 hours; otherwise record it as an accepted risk
End of service	Data is deleted after 3 months	Agree an export of payslips first
Audits	Reference to an ISO 27001 certificate	Request the certificate and check its scope

After a conversation, the supplier agrees to a notification period of 48 hours. The webshop records the agreement in the processing register, under the processing activity “payroll administration”.

Data processing agreements and ISO 27701

ISO 27701 addresses data processing agreements from two sides. The controls for controllers require you to conclude and monitor contracts with processors. The controls for processors require you to work only on instructions, manage sub-processors and help your clients meet their obligations. Which controls apply to your role is set out in requirements of ISO 27701.

The auditor does not only check whether agreements exist. They also check whether the agreements match practice. Missing agreements with smaller cloud tools, such as a survey tool or a planning app, are a common finding.

Common mistakes

Only arranging agreements with the large suppliers. Every tool that handles personal data counts, including free apps.
Signing an agreement and never looking at it again. If you take on more services, the description no longer matches. The AP advises reviewing the agreements regularly.
Unknown sub-processors. You do not know where your data is actually stored.
No agreement on the end of the service. When you switch, data can remain with the old supplier for years.

Frequently asked questions about the data processing agreement

May the processor draft the data processing agreement?

Yes. Usually the controller takes the initiative, but it can also be the other way around. As controller, you always remain responsible for the content.

Is a data processing agreement in the general terms and conditions enough?

It can be, provided that all the mandatory elements of Article 28(3) are included. The GDPR requires a written agreement, and an electronic one counts. A single sentence such as “we comply with the GDPR” is not enough.

What if a supplier will not sign a data processing agreement?

Then you cannot work with that supplier. If you work with them anyway without an agreement, both parties are in breach, according to the AP.