In short
A data processing agreement (German: Auftragsverarbeitungsvertrag, AVV) is a contract between a controller and a processor that is required by Art. 28 GDPR. It sets out in binding terms the conditions under which an external service provider processes personal data on the controller's behalf and on its instructions.
The DPA is neither a voluntary document nor a formality: it is the legal prerequisite for outsourcing data processing to be permissible at all. Without the contract, processing by the service provider is unlawful from the outset, regardless of how carefully the data is actually handled. For SMEs that use cloud services, SaaS platforms, AI tools or classic outsourcing such as payroll accounting and newsletter dispatch, the DPA is therefore part of the mandatory data protection programme.
The term "processing on behalf" describes a clearly defined constellation: a company (the controller) determines the purposes and means of the processing but outsources its operational execution to a third party. This third party (the processor) acts exclusively on the documented instructions of the controller and pursues no purposes of its own with the data. This binding to instructions is the heart of processing on behalf, and the DPA is the instrument that secures it legally and makes it verifiable.
Legal basis: Art. 28 GDPR
The legal basis of the DPA is Art. 28 of the General Data Protection Regulation (GDPR). The provision requires that processing by a processor is governed by a contract or other legal act that binds the processor to the controller. This contract must be concluded in writing, and an electronic form is expressly permitted. A merely verbal arrangement or a loose reference in the terms and conditions is not enough.
Art. 28 GDPR addresses both contracting parties but distributes responsibility asymmetrically: towards data subjects and supervisory authorities, the controller remains obliged to choose a suitable processor that provides sufficient guarantees. The processor, in turn, must comply with the obligations laid down in the contract and may only deviate from the instructions if required to do so by law, in which case it must inform the controller in advance.
When is a DPA required?
A DPA is needed whenever an external service provider processes personal data on your behalf without deciding on the purposes and means of the processing itself. "Processing" is to be understood broadly and also covers merely storing, hosting or making data accessible. In practice this applies to a large share of modern service relationships. Typical cases are:
- Cloud and hosting providers that provide servers, storage or databases holding personal data.
- SaaS platforms such as CRM, ERP, ticketing or project management systems in which customer, employee or prospect data is maintained.
- AI tools and AI services in their business version that process prompts, documents or data sets containing personal data.
- Email marketing and newsletter services that process recipient lists and open or click data.
- External payroll accounting and tax advisers, insofar as they process employee data on your behalf.
- Web analytics, tracking and support tools that collect user or customer data.
- IT service providers with remote maintenance access, insofar as this makes access to personal data possible.
Without a concluded DPA, transferring the data to the service provider in question is not permitted. This also applies if the service provider works reliably from a technical point of view and keeps the data objectively secure: concluding the contract formally is an obligation in its own right that cannot be replaced by actual diligence.
Mandatory content under Art. 28(3) GDPR
Art. 28(3) GDPR prescribes a fixed catalogue of content that every DPA must cover. A contract that leaves out any of these points does not meet the legal requirements. The following overview summarises the minimum components.
| Subject matter | Content in the DPA |
|---|---|
| Subject matter & duration | Description of the specific processing and how long it applies. |
| Nature & purpose | Which processing operations are carried out for which purpose. |
| Categories of data | Which types of personal data are affected. |
| Categories of data subjects | Which groups of people (e.g. customers, employees, prospects) are affected. |
| Binding instructions | Processing only on documented instructions from the controller. |
| Confidentiality | Commitment of the persons authorised to access the data to confidentiality. |
| Technical & organisational measures (TOMs) | Security of processing under Art. 32 GDPR. |
| Sub-processors | Conditions for engaging further service providers. |
| Support with data subject rights | Help with access, erasure, rectification, objection etc. |
| Support for the controller | Help with data protection impact assessments and notification obligations. |
| Deletion or return | Handling of the data after the contract ends. |
| Evidence & audits | Provision of evidence and enabling inspections. |
These points are not to be understood as non-binding recommendations but as a minimum standard. In practice many large providers supply pre-drafted DPA templates that reflect these requirements, but the controller remains obliged to check whether the template actually fits its own processing situation.
Binding instructions and confidentiality
Binding instructions require the processor to process the data exclusively according to the documented instructions of the controller. Any unauthorised use of the data for its own purposes, such as training its own models or enriching its own data sets, would turn the processor into an independent controller and break the construct of processing on behalf. In addition, the contract must ensure that all persons at the processor who have access to the data are committed to confidentiality, unless they are already subject to a statutory duty of confidentiality.
Technical and organisational measures (TOMs)
The DPA refers to the technical and organisational measures required by Art. 32 GDPR. These include encryption, access controls, logging, procedures for restoring availability after an incident and regular review of the effectiveness of these measures. The TOMs are usually documented as an annex to the DPA so that the controller can understand and assess the processor's level of security.
Distinction: controller vs. processor
Classifying a data processing relationship correctly in legal terms determines which instrument is needed. The GDPR knows three basic constellations:
- Controller (Art. 4(7)): The body that, alone or jointly with others, decides on the purposes and means of the processing. It bears the primary responsibility under data protection law.
- Processor (Art. 4(8)): The body that processes personal data on behalf of the controller without determining the purposes itself. A DPA under Art. 28 GDPR is required here.
- Joint controllers (Art. 26): Two or more bodies that decide jointly on the purposes and means. In this case no DPA is needed but a joint controller arrangement that transparently sets out the respective obligations.
In practice the distinction is not always trivial. What matters is who exercises the decisive influence on purposes and means. A classic hosting provider is regularly a processor; a platform that pursues business purposes of its own with the data fed into it, on the other hand, may be an independent or joint controller. A wrong classification leads to the wrong type of contract and therefore to a deficiency under data protection law.
DPAs and AI tools: a common stumbling block
With the use of generative AI in companies, the DPA has gained new practical relevance. If personal data is entered into an AI tool, such as customer enquiries, application documents or internal documents containing personal data, the provider of the AI service is usually a processor. That makes a DPA necessary.
The decisive point here is the distinction between consumer and business versions. A concrete real-world example: for its paid business products, ChatGPT Team, ChatGPT Enterprise and the API platform, OpenAI offers its own Data Processing Addendum (DPA), which fulfils the function of a data processing agreement and, among other things, guarantees that the data entered is not used to train the models. The free consumer version of ChatGPT, by contrast, does not offer this contractual basis in a comparable form. If you process personal data, you should therefore only use business products with a concluded DPA. Microsoft (as part of the Microsoft Products and Services Data Protection Addendum) and Google (Cloud Data Processing Addendum) also provide comparable data processing agreements. If you want to set up the use of AI in your company in compliance with data protection law, treat the DPA question as a fixed part of tool selection; building internal AI literacy helps you assess contracts and data flows correctly.
Third countries: data processing outside the EU
If the processor is based outside the European Economic Area or processes data in a third country, the DPA alone is not enough. In addition, a suitable transfer instrument under Chapter V of the GDPR must be in place. In practice these are above all the Standard Contractual Clauses (SCCs) of the European Commission or, for certified companies based in the USA, the EU-US Data Privacy Framework (DPF). In such cases additional safeguards are often agreed and a risk assessment of the transfer is carried out. The DPA and the third-country transfer instrument therefore complement each other: the DPA governs the "how" of processing on behalf, the transfer instrument legitimises the "where to" of the data transfer.
Consequences of a missing or deficient DPA
A missing DPA is not a trivial offence. Anyone who transfers personal data to a service provider without an effective data processing agreement violates Art. 28 GDPR. Supervisory authorities can punish such violations with fines, which the GDPR sets at up to €20 million or 4% of the company's worldwide annual turnover, whichever is higher. On top of this come possible damage claims from data subjects, reputational damage and the effort of subsequent corrections. In practice a missing DPA often comes to light during data protection audits, complaints or when data breaches are investigated.
Just as problematic is an incomplete DPA that formally exists but does not cover individual mandatory items under Art. 28(3) GDPR, for example with no clear rules on sub-processors or on deletion after the contract ends. Such a contract does not offer complete protection and may be objected to in an inspection. It is therefore worth not adopting providers' DPA templates unchecked but comparing them against the statutory catalogue of mandatory content.
Practical implementation in SMEs
For a mid-sized company, a structured approach is recommended to fulfil the DPA obligation systematically:
- Take stock of all external service providers that potentially process personal data, ideally as part of the record of processing activities.
- Classify each relationship: is it processing on behalf, joint controllership or independent controllership of the service provider?
- Obtain or conclude a DPA for all processors, including checking the TOM annex and the list of sub-processors.
- For service providers with a third-country connection: additionally ensure a suitable transfer instrument (SCCs or DPF).
- Review and update the contracts regularly, especially for new tools, changed data flows or a change of provider.
This turns the DPA from a one-off formality into an ongoing part of data protection management, which, given the dynamic tool landscape in SMEs, is the only sustainable approach.
Frequently asked questions (FAQ)
What is a data processing agreement (DPA)?
A DPA (German: AVV) is a contract between a controller and a processor that is required by Art. 28 GDPR. It governs the processing of personal data by an external service provider on the controller's instructions and is the prerequisite for such outsourcing to be permissible at all.
When do I need a DPA?
As soon as an external service provider processes personal data on your behalf, for example cloud hosting, SaaS tools, AI services in their business version, newsletter dispatch or external payroll accounting. Without a DPA, transferring the data to this service provider is not permitted.
What happens if no DPA has been concluded?
The processing is unlawful. A violation of Art. 28 GDPR can be punished with fines of up to €20 million or 4% of worldwide annual turnover; on top of this come possible damage claims and reputational damage.
Do I need a DPA for AI tools such as ChatGPT?
Yes, as soon as you enter personal data. Business products such as ChatGPT Team, Enterprise or the OpenAI API offer a suitable Data Processing Addendum that serves as a DPA. Free consumer versions generally do not offer this contractual basis and are unsuitable for personal data.
What distinguishes a DPA from a joint controller arrangement?
A DPA applies when the service provider acts as a processor purely on instructions. If, on the other hand, several bodies decide jointly on the purposes and means of the processing, this is joint controllership under Art. 26 GDPR, and a corresponding joint controller arrangement is required instead of a DPA.