Data processing agreements: the clauses to read first

Article 28(3) of the GDPR lists what a contract with a processor must set out and eight duties it must stipulate, points (a) to (h), and the European Data Protection Board (EDPB) says the contract should add concrete detail to them. Our suggested order for reading one is the description of the processing first, then the instructions and transfer terms, then the sub-processor terms, because the rest of the agreement applies to what those three define.

What does the law say a data processing agreement must contain?

Article 28 of the GDPR says processing by a processor must be governed by a contract or other legal act that binds the processor. That document must set out the subject-matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. It must stipulate, in particular, eight duties of the processor, which we group by theme.

The first group concerns control over the data. Under point (a), the processor processes personal data only on documented instructions from the controller, including for transfers to a third country, unless Union or Member State law requires otherwise. Under point (b), it makes sure the people authorised to process the data are committed to confidentiality or under a statutory duty of confidentiality. Under point (c), it takes all measures required by Article 32, and under point (d) it respects the conditions in paragraphs 2 and 4 for engaging another processor.

The second group concerns support and exit. Under point (e), the processor assists the controller, as far as possible, with requests from data subjects, and under point (f) it assists the controller with its obligations under Articles 32 to 36. Under point (g), it deletes or returns all personal data at the controller's choice after the services end, and deletes existing copies unless law requires storage. Point (h) closes the list: the processor makes available all information needed to show compliance and allows for and contributes to audits, including inspections, by the controller or an auditor the controller mandates.

The same paragraph adds that the processor must immediately tell the controller if, in its opinion, an instruction infringes data protection law. Paragraph 9 requires writing, which includes electronic form. Under paragraph 10, a processor that infringes the Regulation by determining the purposes and means of processing is considered a controller for that processing.

Article 83(4)(a) puts the obligations of controllers and processors under Articles 25 to 39, which include Article 28, in the fine tier of up to EUR 10,000,000 or, for an undertaking, up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher.

Does the contract have to say more than the GDPR does?

Yes, according to the EDPB. Its Guidelines 07/2020 on controllers and processors, adopted on 7 July 2021 (version 2.1, with minor corrections of 20 September 2022), say in paragraph 112 that the agreement "should not merely restate the provisions of the GDPR" and should include "more specific, concrete information as to how the requirements will be met and which level of security is required".

Paragraph 114 gives examples. For the type of personal data, it says it would not be adequate "merely to specify that it is 'personal data pursuant to Article 4(1) GDPR'". Instructions must be documented, and paragraph 118 recommends keeping them together with the contract.

A contract written by the supplier is not a problem in itself, according to paragraph 110. The controller still has to evaluate the terms, and by accepting them it accepts full responsibility for compliance. The same paragraph says that publishing a change to standard terms on the processor's website is not compliant with Article 28.

Which parts of a data processing agreement should you read first?

This order is our addition. Neither the GDPR nor the EDPB sets a reading order. We arranged the parts by what each one depends on.

Start with the description of the processing. It is the opening requirement of Article 28(3), and in the Commission's standard clauses it sits in Annex II. Every other term refers to it, so check that the data types and the groups of people are specific, and that the duration or the criteria for it are stated. Next come instructions and transfers under point (a). See who may instruct, in what form, and whether any transfer outside the EU or EEA is allowed. The EDPB says in paragraph 120 that if the instructions allow no transfer to third countries, the processor may not assign the processing to a sub-processor in a third country or have the data processed in its own non-EU divisions.

Third are the sub-processors, under point (d) and Article 28(2) and (4). Look for a list, the type of authorisation, the notice period and what happens after an objection. The next section goes through these. Fourth are the security measures, under point (c) and Article 32. Look for an annex that describes measures. The EDPB says in paragraph 126 that the detail must let the controller assess whether the measures are appropriate under Article 32(1), and the explanatory note in the Commission's Annex III says measures "need to be described concretely and not in a generic manner".

Fifth is breach notice. Article 33(2) says the processor must notify the controller "without undue delay" after becoming aware of a breach, with no number of hours. The controller has its own limit in Article 33(1): without undue delay and, where feasible, not later than 72 hours after becoming aware. The EDPB says in paragraph 136 that it may be appropriate to put a specific timeframe, such as a number of hours, and a contact point in the contract. In our reading, a figure in the contract is what tells you how much of your own 72 hours remains.

Sixth is assistance and audit, under points (e), (f) and (h). Paragraph 143 says the contract should state how often and how information flows to the controller. Paragraph 145 says the GDPR does not cover who pays for audits, but clauses setting clearly disproportionate or excessive fees should not be inserted. Seventh is the end of the contract, under point (g). The controller chooses between deletion and return, and the EDPB says the processor should confirm deletion within an agreed timescale (paragraph 141). Clause 10 of the Commission's clauses adds suspension and termination rights.

Eighth are the short items, which are confidentiality under point (b) and the duty to flag an infringing instruction. They take little time, but check that each is present.

How do sub-processor terms work?

Under Article 28(2), the processor may not engage another processor without prior specific or general written authorisation. With a general authorisation, the processor must inform the controller of intended additions or replacements so that the controller can object. Article 28(4) requires the same data protection obligations to be imposed on the sub-processor by contract, and the first processor "shall remain fully liable to the controller" for the sub-processor's performance.

The EDPB guidelines say in paragraph 157 that the main difference between the two routes is what silence means. Under general authorisation, a controller that does not object within the set time can be taken to have agreed. Paragraph 158 recommends that the contract state the time allowed for approval or objection and the steps after an objection. A footnote to paragraph 128 says it is not sufficient for the processor to give general access to a list that changes from time to time. It must point to each new sub-processor.

The Commission's clauses build the two routes into Clause 7.7. Option 1 is prior specific authorisation with a list in Annex IV, and option 2 is general written authorisation from an agreed list. Both leave the notice period blank for the parties to fill in. On request the processor provides a copy of the sub-processor agreement, which it may redact to protect business secrets.

The EDPB's Opinion 22/2024, adopted on 7 October 2024, concludes that controllers should have the name, address and contact person of all processors and sub-processors readily available at all times, whatever the risk. It also says the controller has no duty to ask systematically for sub-processing contracts and should assess case by case whether a copy is needed.

What do the Commission's standard clauses add?

Commission Implementing Decision (EU) 2021/915 of 4 June 2021 sets out standard contractual clauses between controllers and processors. Article 1 says they fulfil the requirements of Article 28(3) and (4). They are optional: Article 28(6) lets the parties base the contract on them in whole or in part, and the EDPB notes in paragraph 109 of its guidelines that relying on them may help to rebalance negotiating positions.

Clause 2 lets the parties change the clauses only by adding or updating information in the annexes, though they may put the clauses inside a broader contract and add clauses that do not contradict them. The four annexes cover the parties, the description of the processing, the security measures and the sub-processors. Clause 7 covers instructions, security, audit, sub-processors and transfers, clause 8 assistance, clause 9 breach and clause 10 termination.

The clauses do not settle everything. Clause 1(f) says they do not by themselves ensure compliance with the rules on international transfers, and recital 10 says they cannot be used as standard contractual clauses for transfers under Chapter V of the GDPR. Their breach clause also says "without undue delay" and gives no number of hours.

What do German supervisory authorities publish?

We found one sample from a German authority: the Formulierungshilfe für einen Auftragsverarbeitungsvertrag from the Bavarian state office for data protection supervision (BayLDA). The PDF is undated. It says it is not exhaustive, is aimed mainly at outsourcing classic IT services, and is not civil-law advice. A footnote says it is not standard contractual clauses under Article 28(8). Its sub-processor section notes that the parties may agree a complete ban or a ban with approval in individual cases, and it uses the second, with approval possible only once the processor names the sub-processor, its address and its intended activity.

What does this look like on a software project?

Where personal data is involved in a project, our security page says we sign the client's data processing agreement or bring ours, with our sub-processors and security measures attached. How we work covers the contracts for a project, and custom software development covers the work itself.

This article reports what the texts say. It is not legal advice, and a lawyer should confirm how they apply to a specific contract.

What we could not confirm

EUR-Lex blocks automated requests, so we read the Official Journal text of the GDPR and of Decision 2021/915 through the EU Publications Office, which serves the same documents. We did not compare that text with a consolidated version. The Publications Office database lists no amending act for either text. It lists three corrigenda to the GDPR and one to the Decision. We opened one of them, from 2018, which concerns recital 71, and we did not open the others. We also did not check whether any pending EU proposal would change Article 28.

We found no sample agreement from the Datenschutzkonferenz or the Federal Commissioner (BfDI). The BayLDA sample comes from one state authority and carries no date. Neither the GDPR nor the sources we read give a number of hours for a processor's breach notice, and we found no source that says what is usual in contracts.