Skip to content
B2B Prestige AwardsPremium B2B recognition across the United States and Asia

Guide · Contracts

Data Processing Agreement: What It Must Include

· By the B2B Prestige Awards editorial team

A data processing agreement (DPA) is a written contract between a business and a vendor that handles personal data for it. It sets out what the vendor may do with the data, how it must protect it, and what happens when the work ends. If a vendor stores, sends, analyzes or supports anything about your customers, you likely need one.

This guide lists the terms that two major privacy laws require: the European Union's GDPR and California's privacy rules. It ends with a checklist you can use with any vendor.

What a DPA is and who needs one

A cloud host or a payroll tool is a typical processor. A DPA covers a simple relationship. One party decides why and how personal data is used. The GDPR calls it the controller. Another party handles the data on its behalf. The GDPR calls it the processor. California's law calls the second party a service provider or a contractor.

The GDPR has applied since May 25, 2018. It covers data about people in the EU, so a US company that serves EU customers can fall under it. Our guide to GDPR for US companies explains who is covered.

Sources: GDPR (Regulation (EU) 2016/679), Article 28, text as published at gdpr-info.eu; Cal. Code Regs. tit. 11, section 7051

What GDPR Article 28 requires

Article 28 says a controller must use only processors that give enough guarantees to protect the data. The relationship must be governed by a binding contract. The contract must state:

  • The subject and length of the processing.
  • The nature and purpose of the processing.
  • The type of personal data and the groups of people it covers.
  • The rights and duties of the controller.

Article 28(3) then lists what the contract must say the processor will do. In plain words:

  1. Follow written instructions. The processor acts only on the controller's documented instructions, including for transfers of data to other countries.
  2. Keep staff bound to confidentiality. Everyone who touches the data is under a duty to keep it secret.
  3. Secure the data. The processor takes the security measures set out in Article 32.
  4. Control subprocessors. The processor does not hire another processor without the controller's written approval.
  5. Help with people's requests. The processor helps the controller answer requests such as access and deletion.
  6. Help with other duties. This includes security, breach notice and impact assessments.
  7. Delete or return the data. At the controller's choice, when the services end.
  8. Prove compliance. The processor gives the controller the information needed to show compliance and allows audits.

The processor must also tell the controller at once if it thinks an instruction breaks the law. The contract must be in writing, and electronic form counts.

Sources: GDPR Article 28, paragraphs 1 to 3 and 9, gdpr-info.eu

Subprocessors and standard clauses

Vendors often use other vendors. Article 28 deals with this directly. If the processor gets general approval to use subprocessors, it must tell the controller about any planned additions or swaps. The controller gets a chance to object.

The same data protection duties must pass down to each subprocessor in a contract. If the subprocessor fails, the first processor stays fully liable to the controller.

You do not have to write every clause yourself. In June 2021, the European Commission issued standard contractual clauses for controllers and processors. They are ready-made terms that satisfy Article 28(3) and (4). Many vendors offer a DPA built on them or on similar wording.

Sources: GDPR Article 28, paragraphs 2, 4 and 6 to 8, gdpr-info.eu; European Commission Implementing Decision (EU) 2021/915 of 4 June 2021, eur-lex.europa.eu

What California requires

California's privacy law, as changed by the California Privacy Rights Act, also requires a written contract with a service provider or contractor. The state's privacy agency lays out the terms in section 7051 of its regulations. The contract must:

  • Ban the vendor from selling or sharing the personal information.
  • Name the specific business purposes for the work. A vague reference to the whole contract does not count.
  • Ban use or disclosure of the data for any other purpose, including outside the direct business relationship.
  • Require the vendor to follow California's rules and give the same level of privacy protection.
  • Give the business the right to take reasonable steps to check that the vendor uses the data properly.
  • Require the vendor to tell the business if it can no longer meet its duties.
  • Let the business stop and fix unauthorized use, on notice.
  • Require the vendor to help the business answer consumer requests.

A vendor that uses subcontractors needs a matching contract with each one. The rules also say that if you never enforce your contract or never use your audit rights, you may struggle to claim you had no reason to suspect misuse.

Sources: Cal. Code Regs. tit. 11, section 7051, California Privacy Protection Agency regulations, cppa.ca.gov

A DPA checklist for any vendor

Use this list when a vendor sends its standard DPA. Mark each item yes or no.

  • Scope. Does it describe the data types, the people covered, and the length of the work?
  • Purpose. Is each business purpose named in specific words?
  • Instructions. Does the vendor act only on your written instructions?
  • No sale, no extra use. Does it ban selling, sharing or any other use of your data?
  • Security. Does it list real security measures, not just a promise to be careful? A SOC 2 report can back this up.
  • Subprocessors. Is there a list, a notice period for changes, and a right to object?
  • Breach notice. Is there a firm deadline for telling you about an incident?
  • People's requests. Will the vendor help you answer access and deletion requests on time?
  • Audit. Can you review the vendor's controls or get proof of them?
  • Transfers. Does it say where data goes and what rules cover moves across borders?
  • Exit. Will the vendor delete or return the data when the contract ends, and confirm in writing?

Sources: Drawn from GDPR Article 28(3) and Cal. Code Regs. tit. 11, section 7051. The breach notice and transfer items are practical suggestions.

Where the DPA sits in your contracts

A DPA is rarely a stand-alone document. It usually attaches to the main deal, such as a master service agreement, as an addendum. Make sure the main contract says the DPA wins if the two conflict on data terms.

It also helps to review the DPA early. Ask for it at the start of vendor talks, not at signing. Legal and security teams need time, and a vendor that has no DPA ready is a useful warning sign.

Sources: GDPR Article 28(3), gdpr-info.eu; Cal. Code Regs. tit. 11, section 7051(c)

Sources

  1. Regulation (EU) 2016/679 (GDPR), Article 28, Processor. gdpr-info.eu/art-28-gdpr
  2. Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors. eur-lex.europa.eu
  3. European Commission, Standard contractual clauses for controllers and processors in the EU/EEA. commission.europa.eu
  4. California Privacy Protection Agency, CCPA regulations, section 7051, Contract Requirements for Service Providers and Contractors. cppa.ca.gov (archived copy)