The core of the data processing agreement is in the GDPR itself, and that text does not change every year. What does shift is the practice around it: which vendors you use, how those vendors in turn engage sub-contractors, and the rules around transferring data outside the European Union, which the European Commission adjusts from time to time. For most SMEs, you will not notice this in your own contract, but in the annex to it: the list of sub-processors that your vendor engages.
This makes the distinction important. The obligation to conclude a data processing agreement with every party that processes personal data on your behalf remains unchanged. What changes is in the details that fall under that obligation: which sub-processors are active, whether a vendor allows data to be processed outside the EU, and what agreements on this are considered adequate at any given time.
What does not change in the law itself
The obligation to have a data processing agreement, the minimum components that must be included in it, and the role of the controller in relation to the processor: these are fixed parts of the GDPR. There is currently no announced amendment to these provisions. When that does happen, it will be through an amendment to the regulation itself or through a ruling of the European Court of Justice, not through a separate notice from a supervisory authority.
What does shift in practice
Three things typically change, and often without you noticing immediately. First, software vendors expand their functionality, for example by adding AI features on top of an existing tool. This can mean that a new sub-processor is added that you were not previously aware of. Second, supervisory authorities and the EDPB regularly update their guidelines on specific topics, such as cloud storage or international transfers, without the law itself changing. Third, the European Commission sometimes adjusts the standard contractual clauses used for the transfer of data to countries outside the EU.
Sub-processors: the silent shift
Most of the shift in a data processing agreement is not in the main document, but in the annex listing sub-processors. An accounting package that engages a new hosting provider, an HR tool that outsources customer service to a call centre in another country: these are changes that must be reported to you according to the GDPR, so that you can assess whether you object to them. In practice, this is precisely the part that businesses most easily miss, because it is often mentioned in an email with a product update and not in a separate legal notice.
Transfer outside the EU
If a vendor allows data to be processed outside the European Union, there must be a separate legal basis for this, such as standard contractual clauses from the European Commission or a decision that a country offers an adequate level of protection. These legal bases are reviewed from time to time; what was considered adequate at one point can be adjusted later. For you as a customer of a SaaS vendor, this means that the legal basis for an existing agreement can change without the contract itself being amended. What this concretely means for your own vendors cannot be said in general; it requires a look at the specific agreement and the current state of affairs at the Dutch Data Protection Authority.
What this means for your own agreements
The practical question is not whether the law has changed, but whether the sub-processors and the data transfer rules under your existing contracts still match what you once agreed or reviewed. That means periodically checking whether a vendor has reported new sub-contractors, and whether the schedules to your processor agreement are still current. For an initial orientation on what exactly should be included in such an agreement, you can consult the knowledge base on processor agreements; it is freely accessible and selected by topic, with the reference to the legal text included.
It is wise not to see this as a one-time review, but as something that continues as long as you use vendors who process data on your behalf. Anyone using multiple SaaS tools and unsure which sub-processors are involved can find that in the frequently asked questions about ongoing processor agreements. And if you are unsure whether a reported change by a vendor has implications for your own liability, it is advisable to have this reviewed by a lawyer or, if you are uncertain about the correct supervisory authority, to inquire with the Dutch Data Protection Authority.
Entrepreneurs who want to know what such monitoring looks like in practice can read where the information on gdpria.eu comes from and how changes at vendors are tracked.
Check your own situation
Most confusion about "what has changed this year" does not stem from a change in law, but from a vendor that has made adjustments without you noticing. If you want to see in a few minutes whether your own situation needs attention, you can do the free quick-scan or go through the knowledge base on topics relevant to your business.