Data processing agreement (DPA): when you need one and what goes in it
You need a DPA with every service provider that processes personal data on your behalf, such as the company that looks after your servers or your cloud provider (Art. 28 GDPR). It sets out subject-matter, duration, purpose, types of data and data subjects, plus eight duties of the provider from Art. 28(3).
When do you need a DPA?
A processor is a body outside your company, usually another firm, that processes personal data on your behalf (Art. 4(8) GDPR). With it you conclude a contract under Art. 28(3), the DPA. It has to be in writing, and electronic form is allowed (Art. 28(9)).
The European Data Protection Board (EDPB) names two conditions: the provider is a separate company, and it processes the data for you rather than for its own purposes. Typical cases are the company that looks after your servers and accounts, your cloud provider for email and files, and the vendor of your HR software in the cloud.
You need no DPA where someone may only come across data in passing. The EDPB names the IT consultant who fixes a software bug and barely touches any data, and the cleaning company. With them you agree confidentiality and limit access.
Art. 4(8) · Art. 28(1), (3) and (9) GDPR
What has to go in a DPA? The points of Art. 28(3)
First the contract describes the processing: subject-matter and duration, nature and purpose, the type of personal data, the categories of data subjects, and your obligations and rights as controller. Then it binds the provider to eight points.
It processes the data only on your documented instructions, including for transfers to a country outside the EU (point a). Whoever handles the data at the provider is bound to confidentiality (point b). It takes all measures required by Art. 32, the technical and organisational measures, TOMs for short (point c).
It engages another processor only with your prior written authorisation and passes on the same obligations (point d with paragraphs 2 and 4). It helps you when data subjects exercise their rights, for example by asking for access (point e). It helps you with security, breaches, impact assessments and prior consultation under Art. 32 to 36 (point f).
At the end of the service it deletes or returns all data, at your choice, and deletes existing copies, unless the law requires them to be kept (point g). The German text has named the copies only since a correction in 2018. It makes available all information needed to demonstrate compliance and allows audits, including inspections (point h). If it thinks an instruction infringes data protection law, it tells you immediately.
Art. 28(2) to (4) GDPR
Checking the vendor's own DPA
Large vendors put forward their own DPA, often as part of their terms. According to the EDPB that is not a problem in itself. Whoever uses the service still takes on full responsibility, even if they could not negotiate. The EDPB expects concrete information on how the obligations will be met and which level of security applies.
Read the list of sub-processors: under a general authorisation the vendor has to inform you of each new one so that you can object (Art. 28(2)). If it changes its DPA, the EDPB says it should notify you directly; publishing the change only on its website is not enough.
Art. 28(2) GDPR · EDPB Guidelines 07/2020
An example: five suppliers, three DPAs
Brandt Metallbau GmbH (made up, 140 staff) goes through its list of creditors. The company that runs its servers, accounts and backups by remote access handles staff and customer data all the time: DPA. The cloud provider for email and files and the vendor of the time recording system: two more DPAs, both part of the terms, read and filed with their date.
The tax adviser's office runs payroll, and in Germany § 11(2) StBerG makes a tax adviser a controller in its own right for its clients' data: no DPA. The company that maintains the milling machines remotely sees only machine data: no DPA either. It still counts for NIS 2, because of its remote access.
Common DPA mistakes
Signing a DPA with every supplier, including the tax adviser or the cleaning company. The paper then describes roles that do not exist.
Accepting the vendor's DPA without looking at the TOMs. A generic description of the measures falls short; the European Commission's standard contractual clauses expressly require a concrete one in Annex III.
Taking the DPA for your NIS 2 supplier agreement. Its duties under Art. 28(3)(c) and Art. 33(2) concern personal data; an outage or attack without such data is not covered. A supplier with no access to such data has no DPA at all.
Art. 28(3)(c) · Art. 33(2) GDPR · Art. 21(2)(d) NIS 2
With an AI assistant
An AI assistant such as Claude, ChatGPT or Copilot can compare a vendor's DPA with Art. 28(3) point by point and show what is missing, such as concrete TOMs or the list of sub-processors. From your supplier list it can pre-sort who is likely to be a processor.
Your company has to decide: who is a processor, whether its guarantees are sufficient (Art. 28(1)) and whether you accept a contract. Whatever you show the assistant, such as contracts with contact names, its vendor processes too; settle first under which agreement that happens.
If your assistant's vendor itself processes personal data on your behalf, you need a DPA with it as well. A GDPR walkthrough on nisd2.eu is in the works, with the same MCP server as the NIS 2 walkthrough.
Art. 28(1) GDPR
What the NIS 2 walkthrough already records
Item 5.2 records whether security requirements and the reporting of security incidents are agreed with a supplier; that is not a DPA.
5.1 Write down who works for you: on “Your suppliers” each supplier is listed with what it does for you. Whether it is a processor is not something the screen asks; you settle that for each one yourself.
5.2 Record what you have agreed with your suppliers: on “What each one has agreed” you tick, per supplier, whether the contract, the data processing agreement or the terms settle “Security requirements, for example on access and updates” and “Reporting security incidents to you”. 5.2 checks none of the points of Art. 28(3).
Next to each name, 5.2 shows the level from your risk assessment in 2.3. In our reading, that tells you whose DPA to read first.
An AI assistant can fill in both screens, for example from your list of creditors and your contracts; the screen then shows that it filled them in. You check the item and finish it yourself.
Common questions
Is there an official DPA template?
Yes. The European Commission has adopted standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915). Under its Art. 1 they fulfil the requirements of Art. 28(3) and (4) GDPR. You fill in the annexes yourself, the TOMs in Annex III in concrete terms.
Do you need a DPA with your tax adviser?
In Germany, not for the data it processes for you as a tax adviser: § 11(2) StBerG makes it a controller for that data, working free of instructions. This applies to the professions and firms listed in § 3 StBerG, auditors among them. A payroll bureau outside that group you check like any other provider.
Does a DPA have to be signed?
The GDPR requires writing, which may be electronic (Art. 28(9)); the text does not mention a signature on paper. Record which version you accepted and when, so you can produce the contract (Art. 5(2)).
Who is liable if a sub-processor fails its obligations?
Towards you, the initial processor remains fully liable for it (Art. 28(4)). It has to impose on the sub-processor the same obligations that are in your DPA. So read the list of sub-processors before you agree.
Do you need a DPA with ChatGPT, Claude or Copilot?
If the vendor processes personal data on your behalf, yes: it is then your processor (Art. 4(8) GDPR). Whether and for which products a vendor acts that way is in its terms. What that means for each assistant is covered in our articles on ChatGPT and on Claude at work.
Sources
- Regulation (EU) 2016/679 (GDPR), Art. 4(8), Art. 5(2), Art. 28 and Art. 33(2), with the German corrigendum to Art. 28(3)(g) in OJ L 127 of 23.5.2018, CELEX 32016R0679, publications.europa.eu
- Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors, CELEX 32021D0915, publications.europa.eu
- European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1, paragraphs 76 to 89, 110 to 112 and 126, edpb.europa.eu
- German Tax Advisory Act (Steuerberatungsgesetz, StBerG), § 3 and § 11(2), gesetze-im-internet.de
- Directive (EU) 2022/2555 (NIS 2), Art. 21(2)(d), publications.europa.eu, and § 30(2) no. 4 BSIG, gesetze-im-internet.de
- open-isms, messages/durchgang (items 5.1 and 5.2) and lib/mcp/walk.ts, github.com/NISD2/open-isms
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Supply Chain Security
Write down who works for you
A list of your suppliers and service providers.
Supply Chain Security
Record what you have agreed with your suppliers
For each supplier: what does the contract say about security?
In the works
The GDPR walkthrough
After the NIS 2 walkthrough, nisd2.eu is building a GDPR walkthrough. It will work with the same MCP server, so your own AI assistant can fill it in too. We are not naming a date yet. Join the waitlist and we will write to you once it is ready.
With a free account on nisd2.eu. You can leave the waitlist at any time on the same page.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
