Data Processing Agreement - what it must contain and when it is required
A data processing agreement is a contract that a data controller enters into with a data processor when the latter processes data on behalf of and for the benefit of the data controller. This requirement stems directly from Article 28 of the GDPR. This is not merely good practice, but an obligation, and failure to comply constitutes a separate infringement, punishable by a heavy administrative fine. In the public sector, a legal act governed by EU or Member State law may serve as an alternative to a contract.
When is a data processing agreement required?
The need to conclude an agreement is determined by the processor’s role in the process, rather than by mere access to the data. The processor acts on behalf of the controller, in accordance with the controller’s instructions and for the purposes specified by the controller. Typical examples include a cloud or SaaS provider, a hosting company, an accountancy firm handling payroll, an external IT service provider, a document archiving company or a provider of email marketing tools. A data processing agreement is not concluded where the recipient determines the purposes and means of processing themselves. In such cases, they are either a separate controller (such as a bank executing a bank transfer) or a joint controller within the meaning of Article 26 of the GDPR. Nor is a data processing agreement concluded with entities that receive data on the basis of statutory provisions, for example tax authorities, the Social Insurance Institution (ZUS) or law enforcement agencies. This constitutes disclosure, not data processing. Roles are determined by the actual influence over the processing, not by the existence of a document. An entity that begins to determine the purposes of processing itself becomes a controller. The controller’s staff act under the controller’s authority on the basis of authorisation (Article 29), so they do not require a data processing agreement. Data may only be transferred once the agreement has been concluded. Transferring data before the agreement is signed constitutes processing without a legal basis under Article 28.
The obligation to select a processor offering adequate safeguards
Before the controller concludes a contract, they must assess whether the service provider offers sufficient guarantees that appropriate technical and organisational measures will be implemented. In practice, this is done by means of a security questionnaire, a review of certificates and references, and an analysis of the processing location. It is worth retaining the outcome of the assessment, as it serves as evidence of due diligence rather than merely a formality preceding the signing of the contract.
What a data processing agreement must contain
In accordance with Article 28(3) of the GDPR, the agreement must specify the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the controller’s obligations and rights. Furthermore, it obliges the processor to: - process data solely on the documented instructions of the controller, including in relation to transfers to third countries; the instructions may form part of the contract or be a separate document, provided they can be demonstrated, - ensure that persons authorised to process data maintain confidentiality, - implement the security measures required by Article 32, - comply with the terms and conditions governing the use of the services of subsequent processors, - assist in the exercise of the rights of data subjects, - assist in fulfilling the obligations under Articles 32-36, namely security, breach notification, impact assessments and consultation with the supervisory authority, - erasure or return of data upon completion of the services, at the controller’s discretion, together with the erasure of existing copies, unless retention is required by law, - provision of information necessary to demonstrate compliance and to facilitate audits. The data processor must not use the data entrusted to it for its own purposes, such as marketing, nor add it to its own database. The contract must be in writing, including in electronic form. Instead of using their own template, the parties may rely on the standard contractual clauses set out in the European Commission’s Implementing Decision. The EROD emphasises that the contract should not be limited to repeating the provisions of the GDPR. It must specify how the requirements will be met for the data processing in question within specific processes.
Sub-processors and transfers outside the EEA
A processor may not engage the services of another processor without the prior, specific or general written consent of the controller. In the case of general consent, the processor must notify the controller of any planned changes, and the controller has the right to object to them. A typical example is an accountancy firm that uses an external software provider. The obligations under the contract must be transferred to the sub-processor, and the original processor remains liable to the controller for ensuring they are fulfilled. In practice, this means a list of sub-processors in an annex, a deadline for raising objections, and an indication of the location of processing. If any part of the chain operates outside the EEA, the requirements of Chapter V of the GDPR apply, which we describe in the article on data transfers outside the EEA.
The most common errors in data processing agreements
A template found online without a description of the actual processing. Data categories, categories of data subjects and the duration are missing. An agreement that cannot be linked to a specific service is difficult to defend during an audit. No deadline for reporting a breach. The GDPR requires the processor to notify the controller ‘without undue delay’. A specific deadline, such as 24 hours, is a practical solution rather than a statutory requirement, but without it, the controller has no means of effectively enforcing prompt notification by the processor. The controller’s own deadline for reporting to the supervisory authority depends on this. We explain how these breach timings relate to one another in our article on security incidents and data breaches. An audit in name only. The GDPR requires that audits, including inspections, be permitted. A report prepared by the supplier or a certificate may serve as evidence, but they do not replace the right of inspection enshrined in the contract. It is also worth agreeing on how much notice the controller must give before carrying out an inspection. Unregulated termination of the relationship. The data processing agreement should specify who is responsible for returning or deleting the data, by what deadline and in what form, and how this is to be confirmed. Agreement signed and forgotten. A new service feature, a new sub-processor or an additional category of data are not included in the agreement or in the record of processing activities.
Consequences of the absence or inadequacy of a contract
A breach of the obligations under Article 28 of the GDPR is subject to an administrative fine under the GDPR: up to €10 million or up to 2 per cent of total annual global turnover, whichever is higher. The fine may be imposed on both the controller and the processor. The absence of a contract may also constitute evidence of a lack of accountability under Article 5 of the GDPR. The supervisory authority assesses the actual course and conditions of processing, rather than the name of the service in the main contract. A controller who considers that no data processing relationship exists should have a documented analysis of roles.
A contract on paper versus data in systems
The deletion or return of data is an obligation that is the easiest to commit to and the hardest to fulfil. In order to return or delete data once the collaboration has ended, one must know in which systems it is located, including in copies, logs and peripheral environments. This is the same discrepancy between declaration and reality that we describe in our article on data retention and shadow data. This is where a suite of tools comes in handy. Detecto identifies which database tables and columns contain personal data, whilst Revelio does the same for documents and file repositories. Meanwhile, Oblivio carries out deletion or anonymisation in accordance with retention rules and maintains an audit log, which serves as proof of compliance.