Data processing agreement (DPA)
A data processing agreement (DPA, German “AVV”) is the contract required by Art. 28(3) GDPR between a business and a provider that processes personal data on its behalf and under its instructions — such as a hosting provider, an email service or a CRM vendor.
The business remains the “controller”, the provider is the “processor”. The DPA sets out what the provider may do with the data — and what not.
Art. 28(3) GDPR requires the contract to describe subject matter and duration, nature and purpose of processing, the type of data and the categories of data subjects. It must also impose specific obligations on the provider: processing only on documented instructions, confidentiality of personnel, security measures under Art. 32, rules for sub-processors, assistance with data subject rights and notification duties, deletion or return at the end of the contract, and evidence and audits.
The processor may only engage further providers (sub-processors) with prior authorisation (Art. 28(2) GDPR) and must impose the same data protection obligations on them (Art. 28(4) GDPR). Violations of Art. 28 can be fined under Art. 83(4) GDPR with up to €10 million or 2% of worldwide annual turnover.
What to look out for
- Create a list of all providers with access to personal data: hosting, email, newsletter, CRM, accounting, support tools.
- Conclude a DPA with each — large providers usually offer a standard agreement in the customer account.
- Check whether the DPA covers the mandatory content of Art. 28(3) GDPR and describes the technical and organisational measures (TOMs) concretely.
- Request the list of sub-processors and keep an eye on changes.
- Store DPAs centrally so they are quickly available if the supervisory authority asks.
Common mistakes
- There is no DPA at all because “the provider has taken care of it”.
- The purpose of processing is described so vaguely that it covers practically everything.
- New tools are introduced without anyone thinking of the DPA.
Frequently asked questions
Usually yes: the host processes personal data on your behalf, such as form enquiries or server logs. Art. 28(3) GDPR requires a contract for this.
Subject matter, duration, nature and purpose of processing, type of data and categories of data subjects, plus the provider’s obligations under Art. 28(3)(a)–(h) GDPR — from instructions to deletion after the contract ends.
Yes. For hosting, maintenance and software operation, Circle provides its clients with a data processing agreement.
Legal basis: Art. 28(2), (3) and (4) GDPR · Art. 83(4) GDPR · As of