Why a DPA Is Not Optional
Article 28 GDPR is blunt: where processing is carried out on behalf of a controller, it must be governed by a contract. This is not a best-practice nicety — it is a legal requirement, and operating without one is itself a breach, independent of whether any data is ever mishandled. Every business uses processors, often dozens of them, so DPAs are one of the most common GDPR obligations and one of the most commonly neglected.
Controller, Processor — Get the Roles Right First
Before you can paper a relationship, you must classify it. A controller decides why and how personal data is processed. A processor acts only on the controller's instructions. You are the controller of your own customer and staff data; a SaaS vendor handling that data for you is your processor. The wrinkle is that the same organisation can wear both hats: your analytics provider is your processor for your visitors' data, but a controller for its own account-administration data. Two independent controllers sharing data for their own purposes do not need an Article 28 DPA — they need a different analysis. Misclassifying the relationship leads to the wrong contract entirely.
The Mandatory Article 28 Clauses
A compliant DPA must bind the processor to all of the following:
- Documented instructions only. Process personal data solely on the controller's documented instructions, including for international transfers.
- Confidentiality. Ensure everyone authorised to process the data is bound by confidentiality.
- Security. Implement appropriate technical and organisational measures under Article 32.
- Sub-processors. Engage sub-processors only with authorisation and flow down equivalent obligations.
- Data subject rights. Assist the controller in responding to access, erasure, and other data subject requests.
- Security and breach assistance. Help the controller meet its Article 32–36 duties, including breach notification and DPIAs.
- Deletion or return. At the end of the engagement, delete or return all personal data at the controller's choice.
- Audit and information. Make available the information needed to demonstrate compliance and allow audits or inspections.
Handling Sub-Processors
Almost no processor works alone — your CRM uses a cloud host, which uses a CDN, and so on. Article 28 lets a processor use sub-processors only with the controller's prior written authorisation (specific or general), and the processor must impose the same data protection obligations on each sub-processor by contract. Critically, the original processor stays fully liable to you if a sub-processor fails. Strong DPAs publish a current sub-processor list and give you advance notice and a right to object before new ones are added.
Don't Forget International Transfers
A DPA documents the relationship, but it is not, by itself, a lawful basis for sending personal data outside the EU or UK. If your processor or any sub-processor stores or accesses data internationally, you also need a transfer mechanism — most often the EU Standard Contractual Clauses, plus the UK International Data Transfer Addendum or IDTA for UK data, supported by a transfer risk assessment. See our GDPR vs UK GDPR guide for the post-Brexit transfer differences.
A Practical Approach for Businesses
Build a vendor register listing every processor that touches personal data, note whether a DPA is in place, and chase the gaps. Most large vendors offer a standard DPA you can accept; for smaller suppliers, send your own. Review the sub-processor lists annually. This work pairs naturally with the data inventory in our GDPR for small business guide.
GeraCompliance provides a ready-to-use, Article 28-complete DPA template along with the rest of the GDPR document set. For a full programme delivered fast, the GDPR sprint produces your DPAs and supporting documents in days.