Data Processing Agreement (DPA) Under GDPR: What to Include and How to Review One

A data processing agreement (DPA) is the contract GDPR requires whenever one organization processes personal data on behalf of another. If you run a SaaS product and customers upload personal data, you are almost certainly their processor, and they will ask you to sign a DPA. If you use vendors that handle personal data for you, you need DPAs with them too. This guide explains what Article 28 requires, how international transfers fit in, and how to review a DPA.

Related guides: GDPR breach notification requirements · GDPR compliance for SaaS · Data protection impact assessment · Vendor risk assessment

Key takeaways

• A DPA is mandatory under GDPR Article 28 when a processor handles personal data for a controller.
• It must set out the subject matter, duration, nature and purpose of processing, the types of data and categories of people, and eight core processor obligations.
• Transfers outside the EEA need a transfer mechanism, most often the Standard Contractual Clauses or the EU-US Data Privacy Framework for certified US companies.
• Keep a public sub-processor list and a process to notify customers of changes.

---

Controller vs processor

Role	Definition	SaaS example
Controller	Decides why and how personal data is processed	Your customer, deciding to store its users' data in your product
Processor	Processes personal data on the controller's behalf and instructions	Your SaaS company, hosting and processing that data
Sub-processor	A processor engaged by the processor	Your cloud provider, email delivery service or support tool

A company can be a controller for some data and a processor for other data. A SaaS business is usually the controller for its own staff and marketing data, and a processor for customer data inside the product.

What a DPA must include under Article 28

The DPA must describe the processing: its subject matter and duration, its nature and purpose, the types of personal data, and the categories of data subjects. It must also commit the processor to these obligations:

#	Obligation	What it means in practice
1	Process only on documented instructions	Use data only to provide the service, including for any transfers
2	Confidentiality	Staff with access are bound by confidentiality
3	Security	Appropriate technical and organizational measures under Article 32
4	Sub-processors	Only with the controller's authorization, with the same obligations passed down
5	Data subject rights	Help the controller answer access, deletion and other requests
6	Assistance	Help with security, breach notification, DPIAs and prior consultation (Articles 32 to 36)
7	Deletion or return	Delete or return personal data at the end of the service
8	Audits and information	Provide information to demonstrate compliance and allow audits or inspections

International data transfers

If personal data leaves the EEA, the DPA must include a lawful transfer mechanism:

• Adequacy decisions: transfers to countries the European Commission recognizes as adequate, such as the UK, Switzerland, Japan and others.
• EU-US Data Privacy Framework: for transfers to US companies that have self-certified under the framework, based on the July 2023 adequacy decision.
• Standard Contractual Clauses (SCCs): the 2021 clauses issued by the European Commission, with modules for controller-to-processor, processor-to-processor and other relationships, usually attached to the DPA.
• Transfer impact assessment: when relying on SCCs, assess whether the destination country's laws undermine the protection, and add supplementary measures such as encryption where needed.

For UK GDPR, use the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs.

Sub-processors

Most SaaS DPAs use a general written authorization: the customer approves a list of sub-processors and the processor notifies changes in advance, giving the customer a chance to object. Publish the list on your website or trust center with each sub-processor's purpose and location, and keep a DPA with each of them.

DPA clauses that cause the most negotiation

Clause	Customer usually asks for	Reasonable processor position
Breach notification	Notice within 24 hours	Without undue delay and within 48 to 72 hours, with updates as facts emerge
Audit rights	On-site audits at any time	Annual SOC 2 report or ISO 27001 certificate first, audits only if those are insufficient, with notice and at the customer's cost
Sub-processor changes	Right to approve each change	Advance notice with a right to object and, if unresolved, to terminate the affected service
Data location	Data only in the EU	State hosting regions clearly and offer EU hosting if you support it
Liability	Unlimited liability for data protection breaches	Liability cap aligned with the main agreement, sometimes a higher cap for data breaches
Deletion	Immediate deletion on termination	Deletion within a set period, such as 30 days, with backups expiring on their normal cycle

Agree a standard position for each clause in advance, so sales does not have to escalate every DPA.

Technical and organizational measures annex

Most DPAs attach a description of the processor's security measures, often called the TOMs annex. Keep it short and true: access control and MFA, encryption at rest and in transit, logging and monitoring, vulnerability management, backups and recovery, staff training and confidentiality, vendor management and incident response. Link it to your SOC 2 or ISO 27001 controls so it stays consistent with your audits.

DPA review checklist

Use this when you sign a vendor's DPA or a customer sends you theirs:

• Roles are correct (controller, processor, sub-processor)
• Processing details are accurate and specific
• All eight Article 28 obligations are present
• Security measures are described, usually in an annex, and match what you actually do
• Breach notification deadline is realistic, often 24 to 72 hours for the processor
• Sub-processor list and change notice process are clear
• Transfer mechanism is included for any data leaving the EEA or UK
• Audit rights are reasonable, such as relying on a SOC 2 report or ISO 27001 certificate first
• Deletion timeline after termination is stated
• Liability terms align with the main agreement

Common DPA mistakes

• Signing a customer's DPA that promises controls you do not run, such as 24-hour breach notice or unlimited on-site audits
• No DPA with key vendors such as analytics, support or email tools
• Outdated SCCs from before 2021
• Sub-processor list on the website that does not match reality
• No process to delete customer data when contracts end

How SecureSlate helps

SecureSlate keeps your vendor inventory, DPAs and sub-processor details in one place, publishes your sub-processor list in your trust center, and maps DPA obligations to your GDPR controls.

FAQ

Is a data processing agreement mandatory under GDPR?

Yes. Article 28 requires a contract or other legal act between a controller and a processor, setting out the required terms.

What is the difference between a DPA and a data processing addendum?

None in substance. Many SaaS companies attach the DPA as an addendum to their main terms of service.

Do we need a DPA with every vendor?

You need one with every vendor that processes personal data on your behalf, such as hosting, email, support, analytics and payroll providers.

Who should draft the DPA?

Either party can. SaaS processors usually offer a standard DPA. Large customers may insist on their own, which you should review carefully against what you can deliver.

Are SCCs still needed if a US vendor is in the Data Privacy Framework?

If the US vendor is certified under the EU-US Data Privacy Framework, transfers can rely on that adequacy decision. Many companies keep SCCs as a fallback in case the framework is challenged.

---

Do we need a DPA if we only store encrypted data?

Yes, if the data is personal data and you process it on behalf of a customer. Encryption reduces risk but does not remove the Article 28 requirement.

How often should DPAs be reviewed?

When the processing changes, when you add sub-processors in new countries, and when transfer rules change, such as new Standard Contractual Clauses.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory, or professional advice. Requirements vary by framework, industry, and jurisdiction. Consult qualified advisors for your specific obligations.