#GDPR Data Processing Agreement Lawyer (Article 28)

Any business that entrusts a service provider with processing personal data on its behalf must formalise this relationship in a data processing agreement that complies with Article 28 of the General Data Protection Regulation (GDPR). This obligation does not only concern large organisations: it applies whenever personal data is processed by a third party, whatever the size of the parties.

A data processing agreement that is missing, incomplete or non-compliant exposes the controller to a risk of sanctions from the supervisory authorities and may render it liable in the event of an incident. It also exposes the processor if it cannot demonstrate that its actual practices match its contractual commitments.

We assist controllers and processors in drafting, auditing and negotiating their data processing agreements.

What Article 28 GDPR requires in a data processing agreement

Article 28 of the GDPR requires processing carried out by a processor to be governed by a contract that sets out in particular: the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data concerned, the categories of data subjects, and the obligations and rights of the controller.

The contract must also impose specific obligations on the processor: to process the data only on documented instructions from the controller, to ensure that persons authorised to process the data have committed to confidentiality, to implement appropriate security measures, to respect the conditions for engaging sub-processors, to assist the controller in handling data subject rights and personal data breaches, to return or delete the data at the end of the contract, and to make available the information needed to demonstrate compliance.

Drafting and structuring the agreement

We draft personal data processing agreements (also known as DPAs, for data processing agreement) tailored to the relationship between the parties: nature of the processing, volume of data, sensitivity of the categories processed, location of the provider, use of sub-processors.

We make sure the document is consistent with the processor’s actual practices and with the controller’s overall GDPR documentation.

Audit of an existing agreement

Many businesses have signed DPAs without assessing their shortcomings. We analyse your existing contracts, identify missing or insufficiently precise obligations and propose amendments or addenda to bring the documentation into compliance.

Controller or processor: characterising the roles

Correctly characterising the parties (controller, processor or joint controllers) determines the obligations that apply to each. This characterisation is not always obvious, particularly where the provider processes the data for its own purposes in addition to those of its client. We analyse the factual situation and propose the appropriate contractual structure.

Transfers outside the European Union

Where the processor is established outside the European Union or uses sub-processors outside the EU, the contract must incorporate the applicable transfer mechanisms: standard contractual clauses, adequacy decision, appropriate safeguards. We make sure this aspect is properly addressed in the contractual documentation.

For a broader approach to your GDPR compliance, see our page dedicated to the GDPR lawyer and the data protection lawyer.

Sub-processors

The GDPR strictly regulates the processor’s use of sub-processors. The contract must specify whether such use is authorised, under what conditions and with what safeguards. We structure these mechanisms and make sure the chain of responsibility is properly documented.

When to consult us

When you outsource all or part of a personal data processing operation. When a provider offers you a DPA that you wish to review before signing it. When you are preparing a GDPR compliance audit and your contractual documentation needs to be brought up to standard. When a supervisory authority questions you about your documentation on processors.

We are available to analyse your situation and assist you in bringing your documentation into compliance.

Every situation is different: the information on this page is general and does not replace legal advice tailored to your case. The firm makes no promise of outcome; it commits to the means it deploys.