Data protection

What a data processing agreement must contain: the Article 28 checklist

Every supplier that handles personal data for you (your email provider, your payroll bureau, your website host, your CRM) needs a contract with terms the GDPR sets out. The list is in Article 28(3), and it is short enough to check any contract against in one sitting.

By Oscar CobbeCurrent as at 29 October 20263 minute read3 sources

When you need one

Whenever a supplier processes personal data on your behalf, Article 28(3) says the processing must be governed by a contract (or another legal act) that binds the supplier. The EDPB adds that it must be in writing, which includes electronic form. Controller or processor? explains how to tell whether a supplier is one.

Large suppliers publish their own agreement as part of their terms, often called a DPA or data processing addendum, and you accept it with the service. Check it against the list below, as you would one drafted for you.

What the contract must describe

Article 28(3) opens with five things the contract must set out:

1The subject-matter and duration of the processing.
2Its nature and purpose.
3The types of personal data involved.
4The categories of people the data is about.
5The obligations and rights of the controller.

What the supplier must promise

Then eight points, (a) to (h). The supplier, as processor:

1(a) processes the data only on your documented instructions, including about transfers outside the EU, unless the law requires otherwise, in which case it tells you first where it may;
2(b) makes sure the people handling the data are bound to confidentiality;
3(c) takes the security measures Article 32 requires;
4(d) uses another processor (a sub-processor) only with your prior written authorisation, specific or general, and with the same obligations passed down to it;
5(e) helps you answer people's requests to exercise their rights, such as a subject access request;
6(f) helps you with security, breach notification and impact assessments under Articles 32 to 36;
7(g) deletes or returns all the data at the end of the service, as you choose, and deletes copies unless the law requires them kept;
8(h) gives you the information to show it complies, and allows for and contributes to audits and inspections by you or an auditor you appoint.

General authorisation for sub-processors

Where a supplier has general authorisation to use sub-processors, Article 28(2) says it must tell you of any intended addition or replacement, giving you the chance to object. Check how the agreement says that notice will reach you.

Questions worth asking before you sign

The EDPB's guidelines say an agreement should give concrete detail, not merely repeat the GDPR. Four questions bring that detail out:

1Where will the data be held, and where are the sub-processors? A transfer outside the EU needs its own footing: sending personal data to the US.
2How quickly will the supplier tell you about a breach? Your own deadline to the Data Protection Commission starts when you become aware, and the GDPR deadline calculator shows how little time that leaves.
3What security measures does the agreement name? The EDPB says an agreement should say how the requirements will be met, not only restate the law.
4How do you get the data back at the end, and in what format?

Keep a list

Each processor, with its agreement and where the data goes, belongs in your record of processing. It is the list you will want on the day a supplier has a breach or a customer asks who sees their data.

Sources

Free, and no account needed

Work out a breach deadline

If a supplier tells you about a breach, your 72 hours may already be running. Enter when you became aware and see the exact time a report is due.

Run the free check

The GDPR pack, €650 once

The written record of what you hold and why, with your suppliers and their agreements listed, a privacy notice that matches your website, and the steps for requests and breaches.

See the prices

Who wrote this

Oscar Cobbe · Founder, FourWinds Digital

Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.

More about how we work →