A data processor agreement is a written arrangement between two parties: the one who determines why and how personal data is processed, and the one who carries out that processing on their behalf. Under the GDPR, the first is called the controller, the second the processor. You need such an agreement whenever you outsource personal data processing to another company, for example a payroll administration firm, a hosting provider, or a SaaS tool that contains customer data.
The essence is straightforward: the law requires this agreement because the controller remains liable for what happens to the data, even if another company performs the technical work. Without clear arrangements, it is not established what that other party may or may not do with the data, how long it is retained, and what happens in the event of a data breach. A data processor agreement makes this division transparent.
When is there a data processor
Not every party you work with is a processor. A bookkeeper who draws up your annual accounts with their own professional responsibility is usually themselves a controller for that task. A cloud service that stores and processes your customer database according to your instructions is typically a processor. The distinction lies in the question of who determines the purpose and means of the processing. If you are unsure whether a party is a processor, the knowledge base of the Dutch Data Protection Authority provides guidance, and you can also work through this situation by situation in the knowledge base with GDPR topics per situation.
What must be included at a minimum
The GDPR lists a number of matters that must be addressed in a data processor agreement: the subject matter and duration of processing, its nature and purpose, the type of personal data and categories of data subjects, the obligations and rights of the controller, and arrangements on security, confidentiality, sub-processors and how the controller will be assisted with audits. It also covers how a potential data breach at the processor is handled, and what happens to the data once the cooperation ends.
This list appears literally in the regulation itself; if you wish to review the exact wording, you will find it on EUR-Lex. Supervisory authorities such as the EDPB have also published guidelines on how these provisions are interpreted in practice, for example regarding the question of when a sub-processor must be notified in advance.
Who draws up the agreement
In practice, the larger party often provides the template: a software supplier sends their own data processor agreement with a subscription, or a customer sends one to you because you process data for them. This does not mean you must simply sign any text provided to you. It is advisable to check whether all the mentioned topics are included, whether the security arrangements align with what you expect from the other party, and whether liability is reasonably divided. If you are uncertain about a specific clause, it is wise to have it reviewed by a lawyer.
Why this is more than a signature
A data processor agreement is not a formality you handle once and then forget. As soon as a tool supplier changes, you engage a sub-processor outside the EU, or the nature of data processing changes, the existing agreement can become outdated. Companies working with multiple SaaS tools quickly have ten to twenty of these agreements running, each with its own duration and its own arrangements. Keeping track of which agreements exist, which are outdated, and which are missing is a separate task alongside daily business operations.
The security arrangements stated in the agreement also deserve attention: they say something about how a processor handles access, encryption, and incident reporting. For more information on what is relevant in this regard, read the page on security of personal data at processors.
What you can do yourself
When entering into any new collaboration, check whether personal data is being shared, and if so, whether a data processing agreement is needed and in place. Keep these agreements organized, together with your records of processing activities that document which tool processes which data. If you are uncertain whether a specific agreement is complete, you can have it checked for free against the key requirements. For frequently asked questions on this topic, such as what to do if a vendor refuses to sign an agreement, there is an overview on the page with frequently asked questions about the GDPR.
Would you like to know how this fits into your own situation, for example how many data processing agreements you are likely to need and which of them require attention? Take the free quick-scan or register a business account to keep the overview up to date. This way you can see where you stand in just a few minutes, without committing to anything immediately.