Expert knowledge for digital decisions
When Do We Need a Data Processing Agreement?
Short answer
When It Is Necessary
As soon as a third party processes personal data for you and acts under your instructions:
- Hosting providers
- Software service providers with access to production data
- Support that looks into customer records
- Newsletter tools
- Cloud storage where customer data is stored
When It Is Not Necessary
If the service provider makes independent decisions – such as tax consulting or legal advice. In this case, there is no data processing but rather independent responsibility.
What Must Be Included in the Contract
Art. 28 Para. 3 GDPR specifies the mandatory contents: subject and duration, type and purpose, type of data, categories of affected persons, instruction binding, confidentiality, technical and organizational measures, handling of subcontractors, support for data subject rights, deletion after contract termination, proof obligations.
What Is Most Often Overlooked in Practice
Subcontractors. The service provider uses a host themselves. This chain must be disclosed and regulated.
Access to live data during testing. If development is done with a copy of the production database, it constitutes data processing – even if it is "only" a test environment. Better: work with anonymized data.
The Timing
Before processing begins. A contract signed after the first access does not remedy the period before it.
Key facts
- Legal Basis
- Art. 28 GDPR
- Timing
- Before processing begins
- Often Overlooked
- Development with a copy of live data
Sources
All external claims are backed by traceable sources.- 01