Key points
- Article 28 of the GDPR requires any processing of data by a processor on behalf of a controller to be governed by a written contract, or DPA.
- A missing or inadequate DPA is a direct breach of the GDPR, exposing both parties to sanctions from the supervisory authorities.
- The contract must set out the subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects.
- The processor processes the data only on documented instructions from the controller, ensures confidentiality and implements appropriate security measures.
- It assists the controller with data subjects’ rights, breach notification and impact assessments, then deletes or returns the data.
- Using sub-processors requires the controller to be informed and to give its authorisation, with contracts imposing the same obligations.
Article 28 of the General Data Protection Regulation requires any processing of personal data carried out by a processor on behalf of a controller to be governed by a written contract. This contract (often referred to by the acronym DPA, for data processing agreement) is not an optional formality. A missing or inadequate DPA is a direct breach of the GDPR, exposing both parties to sanctions from the supervisory authorities.
In practice, the question is not only whether a DPA exists, but whether its content actually meets the requirements of the Regulation.
What terms must a DPA contain under Article 28?
Article 28 of the GDPR sets out a precise list of the elements the contract must contain. In particular, the contract must specify:
The subject matter and duration of the processing. What task does the processor carry out? For how long? These elements define the scope of the processing covered by the contract.
The nature and purpose of the processing. What type of operations are carried out on the data (collection, hosting, analysis, transmission)? For what purpose are these operations carried out?
The type of personal data and the categories of data subjects. These elements make it possible to assess the level of risk of the processing and to adapt the protective measures accordingly.
The obligations and rights of the controller. The contract must specify the instructions given by the controller to the processor and the rights the controller may exercise (audit, access to the data, request for changes).
What obligations does a DPA impose on the processor?
Beyond these descriptive terms, Article 28 requires the contract to provide for a set of obligations binding on the processor.
The processor may process the data only on documented instructions from the controller, unless a legal obligation provides otherwise. It must ensure that the persons authorised to process the data have committed themselves to confidentiality. It must implement appropriate technical and organisational measures to ensure the security of the data. It must comply with the conditions for engaging sub-processors. It must assist the controller in responding to the exercise of data subjects’ rights (access, rectification, erasure, portability). It must assist the controller in meeting its obligations on security, personal data breach notification and impact assessments. At the end of the processing, it must delete or return the data according to the controller’s instructions. It must make available all the information needed to demonstrate compliance with its obligations and allow for audits.
Sub-processors: the processing chain
Where the processor itself uses service providers that process personal data, it must inform the controller and obtain its general or specific authorisation. It must enter into contracts with these sub-processors imposing the same obligations as those set out in its own DPA. It remains liable to the controller for the performance of these obligations by its sub-processors.
Documentation
The data processing agreement forms part of the GDPR documentation that the controller and the processor must keep up to date. It must be retained, accessible and updated whenever processing practices or the sub-processing chain change.
For assistance with drafting or auditing your processing documentation, see our dedicated data processing agreement lawyer page and our GDPR lawyer page.
For assistance: data processing agreement lawyer.
