At a glance
- A data processing agreement (DPA) is required when a processor handles personal data on a controller’s behalf; the parties’ actual roles matter more than their contract labels.
- The terms must be binding and in writing, including electronic form, but they may sit in a service agreement or annex rather than a standalone document.
- A compliant DPA must cover the processing, documented instructions, confidentiality, security, sub-processors, assistance, deletion or return, and evidence and audits.
- A DPA alone does not resolve international-transfer requirements. Check overseas recipients and remote access, not just where the servers are located.
A data processing agreement defines what a provider may do with personal data, how it must protect the data and how the customer can verify compliance. For a Finnish business, the starting point is Article 28 of the General Data Protection Regulation (GDPR). A vague promise to “comply with the GDPR” is not enough.
When is a data processing agreement required?
A DPA is required where one organisation is a controller and another processes personal data on its behalf. The controller determines the purposes and essential means; the processor acts for it and within its documented instructions.
Actual functions, not contract labels, determine the roles. A provider deciding its own purposes may be an independent controller for that activity. Parties jointly determining purposes and essential means may need an Article 26 joint-controller arrangement instead. One supplier can have different roles for different operations.
Personal data in a business relationship does not by itself create a controller–processor relationship. A bank or professional adviser may use contact details for its own purposes. Remote or occasional access can, however, be processing on the customer’s behalf when it forms part of the service rather than being merely incidental.
Common situations in which a DPA may be needed
Common processor arrangements include a SaaS provider storing customer records, a payroll provider calculating salaries on instructions, a host operating a customer database, or IT support administering systems containing personal data. These are not automatic classifications: a provider may have independent legal duties or use some data for its own purposes. Map what each provider does, who makes the relevant decisions and which group companies or sub-contractors participate.
Does the DPA need to be a separate agreement?
No. Article 28 requires a binding contract or other legal act under EU or Member State law, in writing including electronic form. The terms may be in the service agreement, an annex or a separate DPA. If several documents apply, make their hierarchy and versions clear and avoid an unrestricted supplier right to replace material safeguards.
What must a DPA contain?
The agreement must specify the processing’s subject matter, duration, nature and purpose, the types of personal data and categories of data subjects, and the controller’s obligations and rights. Generic descriptions may be too imprecise for complex or high-risk services.
Article 28(3) then requires the processor terms below.
-
Documented instructions. The processor acts only on the controller’s documented instructions, including for transfers. If EU or Member State law requires other processing, it must inform the controller beforehand unless the law prohibits this for important public-interest reasons.
-
Confidentiality. Authorised people must have committed to confidentiality or be under an appropriate statutory duty.
-
Security. The processor must take all Article 32 measures. The DPA or security schedule should describe assessable technical and organisational measures suited to the risks and processing context.
-
Sub-processors. Prior written specific or general authorisation is required. With general authorisation, intended additions or replacements require notice and a real opportunity to object. The same data-protection obligations must be imposed on the sub-processor, and the initial processor remains fully liable to the controller for their performance.
-
Data-subject rights. Taking account of the processing’s nature, the processor must, as far as possible, assist through appropriate technical and organisational measures with requests such as access, correction and erasure.
-
Security and regulatory assistance. Taking account of the processing and available information, the processor assists with Articles 32–36: security, breaches, impact assessments and prior consultation.
-
Return or deletion. At the controller’s choice, the processor returns or deletes all personal data after the services and deletes copies, unless EU or Member State law requires retention. Formats, timing and back-ups should be workable.
-
Evidence, audits and unlawful instructions. The processor provides information demonstrating Article 28 compliance and allows and contributes to controller or mandated-auditor inspections. It must immediately flag an instruction it considers contrary to applicable EU or Member State data-protection law.
How to review a supplier’s DPA
Large SaaS suppliers often offer non-negotiable terms. A standard DPA can be suitable, but review it with the service description, security material, sub-processor list and transfer information.
- Match the processing description to the features and data you will use.
- Assess instructions, security commitments and incident reporting.
- Review the sub-processor list, change notices, objections and unresolved-objection consequences.
- Test whether audit evidence and inspections give meaningful assurance.
- Check export, deletion, copies and legally required retention.
- Read liability, governing-law and hierarchy clauses alongside the DPA.
Contractual risk allocation cannot erase statutory duties or data subjects’ rights. Nor does every incident create automatic liability: GDPR liability depends on the applicable rule, role, responsibility and facts; contractual claims are separate.
Personal-data breaches and the 72-hour rule
A processor must notify the controller without undue delay after becoming aware of a personal-data breach. It does not automatically have 72 hours: that period concerns a controller’s supervisory-authority notice where required. Agree a prompt channel, information, updates and co-operation. A contractual deadline must not become permission to wait where earlier notice is possible.
A DPA does not solve international transfers
Article 28 and GDPR Chapter V answer different questions. The Commission’s controller–processor clauses in Decision (EU) 2021/915 are distinct from the international-transfer clauses in Decision (EU) 2021/914.
Where data is transferred to a separate organisation outside the EEA, including through remote access, identify a valid Chapter V transfer mechanism and meet its conditions. An Article 28 DPA alone is not enough. Appropriate transfer SCCs can be incorporated into the same contract, but they serve a different purpose. EEA hosting does not exclude transfers to an overseas support company or sub-processor.
A US recipient is not automatically covered by an adequacy decision. Reliance on the EU–US Data Privacy Framework depends on the recipient’s current certification and its scope. Other transfers may require international-transfer SCCs, an assessment of protection in the destination country and supplementary safeguards where necessary.
What if the DPA is missing or incomplete?
A deficient Article 28 arrangement can lead to corrective orders and an administrative fine. For an undertaking, the applicable statutory maximum is the higher of EUR 10 million or 2% of total worldwide annual turnover for the preceding financial year. A fine is not automatic: the authority assesses the circumstances and proportionality. Operationally, unclear instructions, reporting or exit processes can delay breach and rights responses or leave data behind after termination.
When tailored legal help is useful
Legal review is particularly useful for high-risk or large-scale processing, sensitive data, international access, extensive sub-processing, AI or analytics, and inconsistent service terms.
I assist businesses with controller–processor assessments, DPA drafting and supplier contract reviews. The scope, fee and timetable are agreed before work begins. You can also read more about data-protection services and contract services.
Frequently asked questions
We only handle business customer data. Do we still need a DPA?
Possibly, but not merely because records contain names or work email addresses. A DPA is required where one party processes that personal data on the other’s behalf; independent controllers need a different analysis.
Must a DPA be a standalone agreement?
No. It may be part of the main service agreement or an annex, provided that it is binding, in writing including electronic form, and contains the required Article 28 terms.
Can we use a DPA template?
Yes, as a structure. It must still reflect the roles, processing, security, sub-processors, assistance and exit arrangements. The Commission has also published Article 28 standard contractual clauses.
Is a DPA enough when data is accessed outside the EEA?
Not by itself. Access by a separate overseas organisation may constitute a transfer requiring a GDPR Chapter V mechanism and any necessary assessment and safeguards. Check who accesses the data and from where, not only the advertised hosting region. Not every instance of access abroad is a Chapter V transfer; the parties and circumstances matter.
Sources and further information
- General Data Protection Regulation (EU) 2016/679, particularly Articles 4, 26, 28, 32–36, 44–49, 82 and 83.
- European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor in the GDPR.
- European Commission: standard contractual clauses between controllers and processors in the EU/EEA (Decision (EU) 2021/915).
- Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for transfers to third countries.
English adaptation prepared on 3 October 2026. Based on the Finnish guide last updated on 6 September 2026. This guide provides general information and is not a substitute for advice on your specific situation.
