Data Processing Agreement

What is a data processing agreement?

A data processing agreement (DPA; German: Auftragsverarbeitungsvertrag, AVV) is the contract by which a company obliges a service provider to process personal data only on its behalf and in accordance with its instructions. Personal data is any information that can be attributed to a specific person, such as a name, e-mail address or customer number. The legal basis is Article 28 of the General Data Protection Regulation (GDPR), which prescribes the minimum content of the contract. The service provider thus works like an extended workbench: with the company's data, but not for its own purposes.

The law distinguishes two roles. The controller is whoever decides on the purposes and means of the processing (Article 4(7) GDPR), that is, on what data is used for and how. The processor is whoever processes data on behalf of the controller (Article 4(8) GDPR). Typical processors of a technology company are providers of cloud infrastructure, CRM, e-mail dispatch and analytics tools as well as IT service providers with system access. The agreement is usually contained in the provider's standard terms. In the legal due diligence of a funding round or a company acquisition, it falls within the scope of the data protection review.

Mandatory content under Article 28 GDPR

Selection comes before the contract: the controller may engage only service providers that offer sufficient guarantees for the protection of the data (Article 28(1) GDPR). The contract then sets out the subject matter and duration, the nature and purpose of the processing, the type of data, the categories of data subjects and the rights and obligations of the controller. It obliges the processor in particular

• to process data only on documented instructions, including in transfers to third countries, that is, states outside the European Economic Area made up of the EU, Iceland, Liechtenstein and Norway,
• to bind the persons deployed to confidentiality and to implement the technical and organisational measures under Article 32 GDPR, such as encryption, access rights and data backup,
• to engage further processors only under the conditions of Article 28(2) and (4) GDPR,
• to assist the controller with requests from data subjects, with the notification of personal data breaches and with data protection impact assessments (the prior risk assessment of particularly sensitive processing),
• to delete or return all data after the end of the services, unless there is a statutory duty of retention,
• to make available the information necessary to demonstrate compliance and to allow for audits, including inspections.

If the processor considers an instruction unlawful, it must inform the controller immediately. The contract must be in writing, which under Article 28(9) GDPR can also be done in electronic form.

Sub-processors and third countries

If the processor in turn engages service providers, for example a software provider engaging a data centre, it needs the controller's prior specific or general written authorisation. With a general authorisation, it must notify intended changes so that the controller can object. The same data protection obligations must be imposed on the sub-processor; the original processor remains liable to the controller for their compliance.

If the processing takes place wholly or partly outside the European Economic Area, including through a sub-processor, the data processing agreement alone is not enough. A basis under Chapter V GDPR is also needed. This can be an adequacy decision, by which the European Commission certifies that a state has an equivalent level of protection, or standard contractual clauses, that is, model contracts prescribed by the Commission, where appropriate supplemented by further safeguards.

When a data processing agreement is required

Not every service provider that receives data is a processor. What matters is who decides on the purpose and on the essential questions of the how: which data, for how long and who gets access. Under the guidelines of the European Data Protection Board, a processor may choose technical details such as servers or software itself. The actual circumstances are decisive, not the label in the contract.

Joint controllership under Article 26 GDPR

If two or more bodies jointly determine purposes and means, they are joint controllers. An example is two companies that promote a joint event and both use the registration data for their sales. Instead of a data processing agreement, they conclude an arrangement on who fulfils which obligations, above all towards the data subjects. There is no instruction-based relationship. The essence of the arrangement must be made available to the data subjects, and they can exercise their rights against each of the parties (Article 26(2) and (3) GDPR).

Independent controllers

If a service provider decides itself how to handle the data on the basis of its expertise and its professional regulations, it is an independent controller. According to the widespread view, this applies to auditing and legal advice; for tax advisers, the German Tax Advisers Act (Steuerberatungsgesetz) expressly clarifies that they act free of instructions and as controllers. The same applies to a software provider to the extent that it uses customer data for its own purposes, for example to develop its own products. If a processor determines purposes and means on its own authority, it is itself regarded as a controller for that processing under Article 28(10) GDPR.

Significance in due diligence and transactions

The review regularly requests: the record of processing activities under Article 30 GDPR (the overview of which data is processed for what purpose), a list of all service providers with access to personal data and the associated contracts. In addition come the bases for transfers to states outside the European Economic Area and an overview of reported data breaches. Personal data in the data room itself is anonymised or aggregated in early phases, because even its disclosure needs a legal basis.

A missing contract is a separate infringement, even if no data breach has occurred. Under Article 83(4) GDPR it can be punished with fines of up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher. In transactions, such findings are usually remedied before closing and secured through warranties on compliance with data protection law. In a share deal, the contracts stay with the company; in an asset deal, they must be transferred or concluded anew.

Practical example

A software company with 60 employees is preparing a Series A round. The investors' law firm requests an overview of service providers. The inventory shows 23 providers: data processing agreements exist with 17, two are independent controllers (tax advisory and the company's main bank), and four have no agreement, including a webinar tool and a freelance IT administrator with full access.

Three of the 17 providers process data outside the European Economic Area; for two of them, standard contractual clauses are part of the terms, and for the third the basis is unclear. Within two weeks, the company concludes the missing agreements, replaces the unclear provider and updates the record. The investors' law firm notes the finding as remedied, and the participation agreement contains a warranty on compliance with data protection law.

Distinction from related terms

• NDA: obliges to confidentiality about business information but does not meet the requirements of Article 28 GDPR.
• SLA: sets out the scope of services and availability. The data processing agreement supplements it with the data protection obligations.
• Joint controllership arrangement: is concluded under Article 26 GDPR between bodies that jointly determine purposes and means. It allocates the obligations but does not create an instruction-based relationship.
• Transfer to independent controllers: for example to tax advisory, a bank or an investor's law firm. The disclosure then needs its own legal basis; a data processing agreement does not fit.

Common mistakes

• No register of service providers. Anyone who does not know which providers process data can neither maintain contracts nor provide information.
• Provider size as the yardstick. The obligation does not depend on size; even a freelance administrator needs a contract.
• Overlooking the third-country question. The data processing agreement does not replace a basis for transfers outside the European Economic Area.
• Change notifications not reviewed. New sub-processors are accepted even though there is a right to object.
• End of contract without proof of deletion. After cooperation ends, deletion is neither requested nor documented.
• Wrong allocation of roles. If a partner uses the data jointly with the company or for its own purposes, a data processing agreement describes the situation wrongly. What is needed then is an arrangement under Article 26 GDPR or a legal basis for the disclosure.

Frequently asked questions

Does a company need a data processing agreement with its tax adviser?

As a rule, no. Under the Tax Advisers Act, tax advisers act free of instructions and are themselves controllers for their clients' data. If they are to pass documents on to third parties such as investors, a different declaration is needed: a tax adviser power of attorney, which releases them from their duty of confidentiality in that respect.

Is the provider's standard agreement sufficient?

Usually yes, provided it covers the mandatory content of Article 28 GDPR. What should be checked above all are the list of sub-processors, the place of processing and the deletion provision.

Must the agreement be signed by hand?

No. The GDPR allows an electronic format to suffice; accepting the terms in a customer portal is common. The conclusion should be documented in a verifiable way.

What are the consequences of a missing agreement?

An infringement of Article 28 GDPR, which can trigger a fine even without a data breach. In a transaction, the agreement is put in place before closing, and the investor or buyer has compliance with data protection law warranted in the contract.

The Roemer Capital view

In preparing the data room, we include the data protection documents in the request list: the record of processing activities, the list of service providers and, for each provider, the contract. Our aim is a data room that can be made available within 24 hours; missing contracts are thus noticed before the process starts and not only in the review by the investors' law firm.

The legal assessment of individual contracts and of third-country questions lies with the company's law firm or data protection officer. We ensure that the documents are complete and consistent. A contract supplied late is quickly signed; the impression of incomplete compliance, by contrast, is hard to correct.