A data processing agreement is the binding contract that Article 28(3) of the GDPR requires between a controller and a processor. It's mandatory whenever a processor handles personal data on your behalf. It has to be in writing. And it has to cover the processing details plus eight listed terms, which agreements often satisfy on paper only. This guide is information, not legal advice.
It sits inside our wider coverage of EU engineering hiring compliance: contracts, IP and GDPR, and our guide to the legal side of hiring developers in Europe shows where GDPR sits next to code ownership, NIS2 and the AI Act.
What is a data processing agreement?
It's the contract that fixes what a processor may do with the personal data you hand over. The controller decides why and how the data is processed. The processor acts on the controller's behalf. The EDPB's Guidelines 07/2020 on controllers and processors say these roles follow what each party actually does, so a contract label doesn't settle it. The same guidelines say employees with access to personal data inside an organisation are generally not controllers or processors, which is why you don't sign a DPA with your own staff.
Is a data processing agreement mandatory?
Yes, when a processor is involved. Article 28(3) says processing by a processor "shall be governed by a contract or other legal act under Union or Member State law". The EDPB adds that the act must be in writing, electronic form included. Article 28 carries no geographic exception, so the location of the vendor doesn't switch the duty off.
You don't need one when the people with access are your own employees, when no personal data is involved, or when the recipient is an independent controller deciding its own purposes. The last follows from the functional test and is a judgment call to confirm with counsel.
If a vendor that runs its own environments can read personal data while working for you, assume you need one. An individual embedded in your own systems may not be a separate processor; the role test is in our page on access tiers and role tests for outside engineers. HighCircl's short answer on whether you need a DPA for nearshore developers covers that specific case.
What must a data processing agreement contain?
This page is a checklist, not a template; have counsel adapt any wording. The table follows Article 28(3) in order. The third column matters most. The EDPB says the agreement "should not merely restate the provisions of the GDPR", so a clause that only repeats the article text is thin.
| Art 28(3) term | What the contract must say | What to specify beyond restating the GDPR | Check for an engineering vendor |
|---|---|---|---|
| Processing details | Subject matter, duration, nature and purpose, type of personal data, categories of data subjects, controller's rights and obligations | Actual data fields and systems, not "customer data"; named environments | Does the annex list logs, error trackers and support tickets, where personal data hides? |
| (a) Documented instructions | Processor acts only on the controller's documented instructions, including on transfers, unless EU or Member State law requires otherwise; it must immediately tell you if an instruction infringes the GDPR | What counts as an instruction and where it's recorded | Are tickets, SOWs and runbooks named as instruction channels? |
| (b) Confidentiality | Everyone authorised to process is committed to confidentiality or under a statutory duty of confidentiality | Who is covered: employees, freelancers, sub-processor staff | Do freelancers on the vendor's bench sign the same commitment? |
| (c) Security | The processor takes the measures Article 32 requires | The actual controls, as a schedule you can test against | Access method, MFA, secret handling, laptop controls |
| (d) Sub-processors | Conditions in Articles 28(2) and 28(4) for engaging another processor | Approved list, notice period, objection route | Is the cloud host listed? Is a subcontracted freelancer? |
| (e) Data-subject requests | Processor helps you answer data-subject rights requests | Response time and a named contact | Can they find a person's data in logs and backups at all? |
| (f) Assistance under Articles 32 to 36 | Help with security, breach notification, impact assessments and prior consultation | Breach notice in hours, plus what the notice contains | Who on their side is reachable at 2am? |
| (g) Delete or return | At your choice, delete or return all personal data at the end, and delete existing copies unless law requires storage | How you choose, by when, and how deletion is confirmed | Repos, CI variables, logs, staging copies, backups |
| (h) Information and audits | Processor provides what's needed to show compliance and allows audits, inspections included | How often, with what notice, and what evidence replaces a visit | Will they accept a certification report plus questions? |
The five clauses engineering teams under-negotiate
In our judgment these five are where an incident or an offboarding goes wrong, so they're where negotiating time pays. Each one is a place where the GDPR text leaves the specifics to your contract.
Instructions: what counts as a documented instruction
The EDPB treats written instructions, email included, as enough form. The risk is that nobody can say which instructions exist. For an engineering vendor, instructions arrive in tickets, pull request comments and chat. Say in the annex which of those count, who on your side can issue one, and that anything outside them is not an instruction.
Keep the Article 28(3) duty that the processor must immediately tell you if, in its opinion, an instruction infringes the GDPR. It sounds theoretical until a contractor is asked to copy a production table into a staging database.
Sub-processors: lists, notice and silence
Where sub-processors are approved at signing, the EDPB says the list belongs in the contract or an annex and must be kept up to date. Then decide which authorisation model you're signing, because silence means opposite things under each.
Under specific authorisation, the EDPB says a request not answered within the set timeframe "should be held as denied". Under general authorisation, the processor informs you of intended additions or replacements so you can object, and your failure to object within the timeframe can be read as consent. The contract, per the EDPB, should give the timeframe and the steps after an objection.
So write three numbers into the clause: days of notice before a new sub-processor starts, days you have to object, and what happens if you do. "We'll let you know" isn't a clause. Under Article 28(4), the sub-processor carries the same obligations and the first processor stays fully liable, which is a useful point when a vendor resists.
Breach notice: ask for hours, not "undue delay"
Article 33(2) says the processor notifies the controller "without undue delay after becoming aware". The controller's own duty under Article 33(1) is notice to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. Those are two separate duties.
The EDPB says the parties may put a specific timeframe, "e.g. number of hours", into the contract, along with the point of contact, how notice is sent and the minimum content you expect.
Use that. Our judgment: a processor window of 72 hours means you may not hear about a breach for three days, while Article 33 still expects the processor to tell you without undue delay and you carry the accountability. Ask for a much shorter figure. No source sets a standard number, and 24, 48 or anything else is a negotiated figure, not law. Whatever you pick, name a contact who answers outside office hours, and define the minimum content of the first notice.
Deletion at the end of an engagement
Article 28(3)(g) gives the choice of delete or return to the controller, not the processor, so a clause that only offers deletion takes away a right you hold. The EDPB says the contract should let you change that choice before the services end, that deletion should be completed in an agreed timescale and manner, confirmed to you, and that the processor must delete all existing copies unless EU or Member State law requires further storage.
"All copies" needs translating for engineering work. As practice, not law, list: repositories and forks, CI variables and secrets, logs, staging databases, backups, and contractor laptops. Ask for written confirmation covering each, and for access to be revoked on the last day. No standard exists for how fast, so state your own date.
Audit and information rights
Article 28(3)(h) requires the processor to make available the information needed to show compliance and to allow audits, inspections included. The EDPB adds that the contract has to say how often and how the flow of information takes place. The ICO's UK GDPR guidance lists audits and inspections among its eight minimum terms for the same reason.
On-site audits of a small agency are rarely practical. Our view: accept an independent certification report, such as a SOC 2 or ISO 27001 report, plus a round of questions in place of an on-site visit, but only if the contract says so. Otherwise you've given up a right informally and can't enforce it.
Data processing agreement vs NDA vs SCCs
These three get confused, and "what is the difference between an NDA and a DPA" is a question people often ask.
| Document | What it governs | What it leaves out |
|---|---|---|
| NDA | Confidentiality of information shared between the parties | Instructions, sub-processors, deletion and audits. Confidentiality is only term (b) of Article 28(3) |
| Data processing agreement | How a processor handles personal data for a controller, under Article 28 | The legal basis for moving data to a third country |
| Standard contractual clauses | The Commission has published clauses for controllers and processors under Article 28(7) that you can use instead of drafting your own; a separate set covers transfers to third countries | The commercial terms of the engagement |
The EDPB says controller and processor may negotiate their own contract with all compulsory elements or rely, in whole or in part, on standard contractual clauses. Using the Commission's Article 28 clauses is therefore optional, and the Commission's page links a Q&A, dated 25 May 2022, on both sets of standard contractual clauses (Article 28 and transfers). Which transfer mechanism applies depends on where the data goes; our guide to international data transfer agreements covers that question. An EU-to-EU engagement needs no transfer clauses, though it still needs the Article 28 contract.
The ICO guidance cited here is UK GDPR guidance, not EU law. Its eight headings match the EU list, so it's a useful cross-check, but it isn't authority for an EU contract. It sets no deadline for processor breach notice, which is another reason to write one in.
What this means before you sign or ask for a DPA
The decision is whether a vendor or contractor gets production access on the contract as offered. Don't grant access on a draft. Get the agreement signed first, with the sub-processor list attached.
Then change five things, in this order. Replace "without undue delay" with a number of hours and a named contact. Write the deletion choice and a confirmation date into the contract. Set the sub-processor notice and objection periods. Name which channels count as instructions. Decide in advance what audit evidence you'll accept. These are judgment calls, but each one maps to text the EDPB says a good agreement addresses.
If a customer's security team has just sent you a questionnaire with contractor rows, the evidence you attach is covered in answering the contractor rows on a security questionnaire.
FAQ
What is a data processing agreement?
It's the written contract Article 28(3) of the GDPR requires between a controller and a processor. It sets out the processing details and eight terms, from instructions and confidentiality to deletion or return and audits.
Is a data processing agreement mandatory?
Yes, whenever a processor handles personal data for you. Processing by a processor "shall be governed by" a contract, and the EDPB says it must be in writing. It isn't needed for your own employees or for a recipient that is a genuinely independent controller, which is worth confirming with counsel.
What is the difference between an NDA and a DPA?
An NDA protects confidential information. A DPA governs how a processor handles personal data and must set instructions, sub-processor conditions, deletion or return, and audit rights. Confidentiality is only one of the Article 28(3) terms, so an NDA can't stand in for a DPA.
How quickly must a processor report a personal data breach?
Article 33(2) says "without undue delay after becoming aware", with no fixed number of hours. The EDPB says the parties may agree a timeframe, "e.g. number of hours", in the contract. The controller's 72 hours to notify the supervisory authority is a separate duty. A processor allowing itself 72 hours means you may not hear about a breach for three days, so ask for a much shorter figure.
Can we use the European Commission's standard clauses as our DPA?
Yes, in whole or in part. The EDPB says controller and processor may rely on standard contractual clauses instead of negotiating their own contract, and the Commission publishes clauses for this under Article 28(7). Have counsel confirm they fit your engagement.
Does a data processing agreement need standard contractual clauses?
Not for an EU-to-EU engagement. Transfer clauses apply when data goes outside the EEA without an adequacy decision, but the Article 28 contract is still required.