Data processing agreement

What it means

A data processing agreement governs the relationship between the controller, who decides the purpose and means of processing, and the processor, who processes on the controller’s behalf. GDPR requires one whenever that relationship exists.

It must state the subject matter and duration, the nature and purpose, the categories of data and data subjects, and both parties’ obligations - confidentiality, security measures and what happens to the data when the engagement ends.

Not every supplier that sees personal data is a processor. An auditor, a lawyer or a bank processes data for its own purposes under specific laws and acts as an independent controller; no processing agreement is signed with them, although confidentiality and data protection in the relationship are governed by other rules.

How it works in practice

In a company it covers everyday suppliers: the accounting firm, the payroll system, cloud storage, the e-mail service, the CRM, marketing tools and IT support. It is not a formality for large corporations but a standard schedule to the contract.

It also handles sub-processors: the supplier may not engage one without consent and must pass on the same obligations. That is why, under outsourcing, we ask where the data physically sits.

With every client whose payroll we run, we sign a processing agreement as processor. The client then lists it in the record of processing activities under payroll, so that in an inspection it can show who has access to employee data and on what basis.

What to watch out for

A missing agreement is a breach any inspection finds first - and it is the controller’s breach, which means yours. The document alone is not enough either: real access controls and measures such as pseudonymisation or encryption have to match it.

With a supplier whose servers or support sit outside the EU, the processing agreement alone is not enough: a transfer to a third country needs its own legal basis, such as standard contractual clauses. Without it the controller bears the breach, and cyber insurance need not cover the fine or the cost of the incident.