The data processing agreement: when do you need one?

Controller and processor

The GDPR (AVG) distinguishes between two roles:

• The controller determines why and how personal data is processed. Usually that is you, for the data of your customers and employees.
• The processor processes personal data on behalf of the controller, without determining the purpose itself. Think of a hosting provider or a payroll provider.

When is a data processing agreement mandatory?

As soon as a processor processes personal data for you, that processing must be governed by a contract or another binding legal act (art. 28 lid 3 GDPR). This also applies if the processor is a large company with standard terms. In that case the data processing agreement is often included in those terms, or you can accept it in your account.

No data processing agreement is needed if the other party processes the data for its own purposes. That party is then a controller itself. If you jointly determine the purpose and means, you are joint controllers and must make arrangements between you (art. 26 GDPR).

What must it contain?

Art. 28 lid 3 GDPR lists what the agreement must govern at a minimum. Among other things:

• the subject matter, duration, nature and purpose of the processing;
• which types of personal data and which categories of data subjects are involved;
• that the processor only acts on your documented instructions;
• that the people who work with the data are bound by confidentiality;
• that the processor takes appropriate security measures (art. 32 GDPR);
• under which conditions the processor may engage a sub-processor;
• that the processor assists you with requests from data subjects and with your own obligations, such as reporting data breaches;
• that the data is deleted or returned at the end;
• that the processor provides the information needed to demonstrate compliance, and allows audits.

Checklist

• Make a list of all suppliers that process personal data for you.
• Determine per supplier: processor, independent controller or joint controller?
• Check that there is a data processing agreement with every processor.
• Check where the data is stored, and whether it leaves the EU.
• Do you process data for customers yourself? Then you are their processor and there should also be an agreement.