Yes, you can draw up a data processing agreement yourself. The GDPR does not prescribe a mandatory format: there is no official template you must use, only a set of topics that the agreement must cover in any case. For a simple relationship with one clearly defined service, without sub-processors and without data transfers outside the EU, drawing it up yourself is often achievable in an afternoon's work.
The question is not so much whether it is permitted, but whether the situation is straightforward enough to do well without help. As soon as there are multiple parties in the chain, sensitive data are processed, or the other party sends its own draft agreement that differs from what you need, drawing it up yourself becomes harder to oversee. In that case, legal advice, or at least a structured review, is wiser than filling in a template and hoping it is correct.
What must be included in any case
Regardless of who draws up the agreement, a data processing agreement regulates a fixed set of topics. It sets out what the subject matter and duration of processing are, which categories of personal data and data subjects are involved, and what the purpose of processing is. Additionally, the agreement establishes that the processor acts only on instruction from the controller, that employees of the processor are bound by confidentiality, which security measures apply, how sub-processors are engaged and notified, how the processor cooperates with requests from data subjects and data breach notifications, and what happens to the data after the agreement ends. These elements are literally in the regulation itself; whoever is missing them in a draft is missing something that should be there.
When drawing it up yourself works in practice
Drawing it up yourself works well when the relationship is straightforward: you are the controller, you engage one supplier for one defined service, there are no known sub-processors outside the EU, and the data are not particularly sensitive. Think of an accounting package, a mailing tool or a scheduling system for which the supplier already offers a standard version. In that case, your job is mainly to check whether the standard text covers the fixed elements, and whether the agreements made match what the tool actually does. Anyone who wants to have that overview for the tools used daily will find in the knowledge base with the fixed elements per situation a framework to work against.
When outsourcing is wiser
The boundary shifts as soon as the chain becomes more complex: multiple sub-processors, transfers to countries outside the EU, processing of health data, biometric data or data concerning minors, or a counterparty that supplies its own draft that differs from what you expected. In those cases, the risk is not that you have no agreement, but that you sign or draw up one that does not cover what actually happens. A lawyer or specialized adviser can then assess whether the agreements fit with the actual data flow, something a template cannot do for you.
Using a template is different from drawing it up yourself
There is a difference between using a template as a starting point and writing an agreement entirely yourself. A template forces you to go through the fixed elements, but does not automatically fill them in correctly for your situation. The same applies conversely to an agreement that a customer or supplier sends you: it may look complete and still be missing an element, or contain an agreement that does not match what actually happens in practice. Answers to frequently asked questions about this, such as what a customer can reasonably expect and what it cannot, are collected in the frequently asked questions about data processing agreements.
What gdpria.eu does in this regard
Checking a data processing agreement that someone sends you, and looking up the mandatory components in the knowledge base, is free and requires no account. The system around it — the document set with templates, monitoring of active agreements, and the deadlines attached to them — is included in the subscription. What's included is clearly set out in the overview of subscription forms. We provide guidance and structure, not legal advice: you decide yourself whether to draft it yourself, use a template, or engage a lawyer.
Would you like to see how this works in practice before you create anything? Browse through the topics in the knowledge base, or create a business account to set up the register and monitoring for your own data processing agreements.