Key points
- A data processing agreement (DPA) allocates liability between the parties if the GDPR is not complied with, and the financial stakes are real.
- The controller is liable for damage caused by non-compliant processing, whereas the processor is liable only in respect of its own obligations or if it acts outside the controller’s instructions.
- The internal allocation clause provides that each party bears the failures attributable to it: security and transfers for the processor, legal basis and information for the controller.
- The processor often limits its liability with a cap, which however cannot be enforced against data subjects or supervisory authorities.
- The cap must reflect the nature of the data: a processor handling sensitive data should accept a higher cap.
- Mutual indemnity and recourse clauses allow the party that has borne a penalty to seek recovery from the other party.
The personal data processing agreement (DPA) sets out not only each party’s obligations, but also how liability is allocated between them if the GDPR is not complied with. This allocation is not neutral: in the event of an incident or an investigation by the CNIL (French data protection authority), it determines who ultimately bears the financial consequences as between the parties. It does not, however, bind data subjects or the supervisory authority. Drafting the liability clauses in a DPA therefore deserves specific attention.
Liability under the GDPR: an allocation set by law
The GDPR sets a liability framework between controller and processor. Any controller involved in processing is liable for the damage caused by processing that does not comply with the regulation; it must also choose a processor providing sufficient guarantees (Article 28(1)). The processor is liable for the damage only where it has not complied with the obligations specifically directed to processors or has acted outside the lawful instructions of the controller (Article 82(2) of the GDPR). It may also be pursued directly by supervisory authorities for failures to meet its own obligations (Article 28 obligations, security, sub-processing, transfers).
Liability between the two parties in their internal relationship, meaning who ultimately bears the cost of an incident, is governed by the contract. This is where liability clauses come into play.
The internal liability allocation clause
The DPA must specify how liability is allocated between the parties where a data subject suffers damage or a supervisory authority imposes a penalty. The general rule is that each party bears the liability corresponding to the part of the processing for which it was responsible and to the failure attributable to it.
In practice, this means that the processor bears the consequences of its own failures (security failures, unauthorised use of sub-processors, non-compliant transfers), while the controller bears the consequences of the failures for which it is responsible (no legal basis, insufficient information to data subjects, non-compliant purposes).
These clauses form part of the contract required by Article 28 of the GDPR. Our GDPR lawyer drafts and negotiates them, on the controller side as well as on the processor side.
Capping the processor’s liability: the limitation of liability clause
The processor will generally seek to limit its financial liability through a compensation cap, often expressed as a multiple of the fees received over the relevant period. This limitation is in principle valid between the parties, but it cannot be enforced against data subjects or supervisory authorities: where the controller and the processor are both responsible for the same damage, each is liable for the entire damage towards the data subject (Article 82(4) of the GDPR).
Negotiating the liability cap must take into account the nature of the data processed, the volume of processing and the potential risks. A processor handling sensitive data within the meaning of Article 9 of the GDPR (health data, for example) or high-stakes data such as financial data should accept a higher cap than one processing data of low sensitivity.
Indemnity and recourse clauses
The DPA may provide for mutual indemnity obligations: the processor indemnifies the controller for damage resulting from its own failures, and vice versa. These clauses must be precise as to the triggering conditions, the notification and cooperation procedures, and the time limits.
A recourse clause allows the party that has borne a penalty or paid compensation because of a failure attributable to the other party to turn to that party to recover the sums paid. For compensation of data subjects, this recourse is in fact provided for by Article 82(5) of the GDPR, in proportion to each party’s share of responsibility.
For assistance in drafting your DPA, see our page dedicated to the GDPR data processing agreement lawyer.
For assistance: GDPR data processing agreement lawyer.
