Data processing agreement: when is it required and what must it contain?

A data processing agreement (verwerkersovereenkomst) is required whenever a supplier processes personal data on your instructions, such as a payroll bureau, a hosting provider or a CRM supplier. Article 28 GDPR requires a written contract with fixed minimum content; it is not required, and is even the wrong document, where the other party is an independent controller or a joint controller.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) checks these agreements in investigations. A missing agreement is an infringement of Article 28 GDPR by both parties, punishable under the fine bracket of Article 83(4) GDPR.

When do you need a data processing agreement?

You need one when one party processes personal data on behalf of another. The party that decides why and, in essence, how data are processed is the controller; the party acting on its instructions is the processor.

No processing agreement is needed between independent controllers, each pursuing their own purposes. Joint controllers need an arrangement under Article 26 GDPR instead. A processor that engages a sub-processor must sign an equivalent contract with it, so the obligation runs down the whole chain.

How do you tell a controller from a processor?

The test is functional: what the parties actually do counts, not what the contract calls them. The reference point is the European Data Protection Board’s (EDPB) Guidelines 07/2020, adopted in final form on 7 July 2021; see also our article on the difference between a controller and a processor.

The controller decides the purposes and the essential means: which data, about whom, for how long and to whom they are disclosed. In case C-683/21 (CJEU 5 December 2023), the Court of Justice held that an organisation can be a controller even if it never touches the data itself. A processor that uses data for its own purposes becomes a controller for that processing (Article 28(10) GDPR).

The roles that most often cause confusion are:

• Payroll bureaux: a processor when they only process the data you supply; a controller when they give independent advice in their own professional judgement.
• Accountants and tax advisers: statutory audit and tax return work are done under their own professional duties, which points to controller status.
• Marketing agencies: a processor when running your campaign on your customer list; possibly a joint controller when they build or enrich audiences.
• IT, hosting and SaaS suppliers: normally processors, but a clause allowing use of “usage data” for product improvement or model training makes them a controller for that use.

What must the agreement contain?

Article 28(3) GDPR sets a fixed list of mandatory content. The EDPB is clear that simply repeating the text of the regulation is not enough.

• a description of the processing: subject matter, duration, nature, purpose, types of data and categories of data subjects;
• processing only on documented instructions, including on transfers outside the EEA;
• confidentiality of the persons authorised to process the data;
• the security measures of Article 32 GDPR, set out in an annex;
• the conditions for engaging sub-processors;
• assistance with data subject requests, data breaches and data protection impact assessments;
• deletion or return of the data at the end, at the controller’s choice;
• information and audits to demonstrate compliance, and a duty to warn if an instruction infringes the GDPR.

The Commission’s standard clauses for controllers and processors (Implementing Decision (EU) 2021/915) are optional. You may use your own contract, as long as it contains everything Article 28 GDPR requires.

Which clauses should you negotiate?

The mandatory list is the minimum; the value lies in making it concrete. Five clauses decide whether the agreement works when something goes wrong.

Sub-processors

Under Article 28(2) GDPR, the processor needs your specific or general written authorisation. With general authorisation, the processor must inform you of changes and give you the chance to object; negotiate a notice period you can act on and a right to terminate without penalty if you object.

Security

Annex the actual measures: encryption, access control with multi-factor authentication, logging, back-ups and where data are stored. In case C-340/21 (CJEU 14 December 2023), the Court held that a breach alone does not prove the measures were inadequate, but the controller must show they were appropriate. A dated annex is that evidence.

Data breaches and data subject requests

You must notify the AP of a data breach within 72 hours of becoming aware of it (Article 33 GDPR), and answer data subject requests within one month (Article 12(3) GDPR). Agree that the processor notifies you of a breach within a fixed short period, for example 24 hours, and forwards requests within a set number of working days.

Organisations within scope of the Dutch Cybersecurity Act (Cyberbeveiligingswet), which implements the NIS2 Directive and has applied since 15 August 2026, also have their own incident reporting duties. Align the two procedures in the agreement.

Audits

Article 28(3)(h) GDPR requires the processor to allow and contribute to audits. A clause offering only “our latest certificate” falls short; a common compromise is an annual assurance report plus a right to audit after a breach or at the AP’s request.

Liability

Under Article 82 GDPR, a data subject can claim compensation from the controller and, where it breached its own obligations, from the processor. Each can be liable for the full damage, with recourse afterwards. Check that the liability cap and the exclusion of indirect loss do not empty the indemnity, especially as collective actions under the Dutch WAMCA regime make larger claims realistic.

What if data leave the EEA?

If the processor, a sub-processor or its support staff can access the data from outside the European Economic Area, Chapter V GDPR applies on top of Article 28. Remote access counts as a transfer; see our explanation of international data transfers.

Without an adequacy decision (Article 45 GDPR), the usual tool is the standard contractual clauses of Implementing Decision (EU) 2021/914 (Article 46 GDPR). After the Schrems II judgment (CJEU 16 July 2020, C-311/18), you must also assess whether the law of the destination country allows the importer to comply, and document that assessment.

For the United States, the EU-US Data Privacy Framework adequacy decision of 10 July 2023 applies, but only to recipients that are certified under it. The General Court upheld the decision on 3 September 2025 (case T-553/23, Latombe). The AP fined Uber €290 million in 2024 for transferring drivers’ data to the US without a valid transfer tool.

What should you check as a controller?

As the controller, you remain accountable for what your suppliers do with the data. Check these points before you sign a supplier’s standard agreement.

• Is the supplier really a processor, or an independent controller for which a processing agreement is the wrong document?
• Is the description of the processing completed, and does nothing allow use for the supplier’s own purposes?
• Are the security measures annexed and specific?
• Is breach notification bound to a fixed short period?
• Is there a real audit right and a sub-processor list with notice and a right to object?
• Is the right transfer tool in place for every party outside the EEA?

What should you check as a processor?

As a supplier, you take on obligations under Article 28 GDPR that you must actually be able to meet. Check these points before you accept a client’s template.

• Can you follow the instructions as written, or do you in fact act on your own account?
• Can you meet the breach notification and response deadlines with your current team?
• Have you signed back-to-back agreements with all your sub-processors?
• Is the audit right limited in scope, frequency and costs?
• Does the liability clause match your insurance cover?

What can we do for you with a data processing agreement?

We draft, review and negotiate processing agreements as part of our work as IT lawyer.

• We assess whether your supplier is a processor, a joint controller or an independent controller.
• We review a supplier’s standard agreement against Article 28 GDPR and mark the clauses to negotiate.
• We draft a processing agreement or intra-group framework with concrete annexes.
• We check the transfer tools and the transfer impact assessment for processing outside the EEA.
• We assist you in an investigation by the Autoriteit Persoonsgegevens.

Summary

• Article 28 GDPR requires a written data processing agreement whenever a supplier processes personal data on your instructions.
• Independent and joint controllers need a different instrument; joint controllers need an Article 26 arrangement.
• The agreement must contain the fixed list of Article 28(3) GDPR; concrete annexes on security, breaches and sub-processors make it work.
• Transfers outside the EEA require an additional transfer tool and a documented assessment.

Frequently asked questions