In short
If a SaaS vendor processes personal data on your behalf, you need a data processing agreement under Article 28 GDPR. It must be in writing or electronic form and covers instructions, confidentiality, security measures, sub-processors, deletion and audit rights. Review the TOM annex, the sub-processor list and the legal basis for international transfers most closely.
Mandatory: if a SaaS vendor processes personal data on your behalf, Article 28 GDPR requires a contract with fixed minimum content.
Form: the DPA must be in writing, an electronic format is sufficient.
Core terms: documented instructions, confidentiality, technical and organisational measures, sub-processors, deletion at the end, audit rights.
Responsibility stays with you: you must choose the vendor carefully before use.
Almost every business tool processes personal data: names in chat, contacts in the CRM, billing addresses in accounting. When this data sits with a SaaS vendor, you need a data processing agreement (DPA). This guide explains what a DPA must contain and how to review a vendor's standard terms.
When do you need a DPA?
You need a DPA when a service provider processes personal data on your behalf and under your instructions. Article 4(8) GDPR defines this role as processor. The German data protection conference (DSK) lists typical cases in its short paper no. 13:
cloud computing without the operator accessing the content
outsourced email management or backups
remote maintenance and external support where access to personal data cannot be ruled out
data entry, data conversion or document scanning
According to the DSK, using independent professional services is usually not processing on behalf. Examples are tax advisers, lawyers or banks handling payments. They act as controllers in their own right. For SaaS tools such as team chat, CRM or project management, the vendor is almost always a processor.
What must a DPA contain?
Article 28(3) GDPR sets out the minimum content. The contract describes the subject matter and duration, the nature and purpose of processing, the types of data and the categories of data subjects. It also sets out eight obligations of the vendor:
Obligation (Art. 28(3)) | What to check |
|---|---|
(a) Documented instructions | Does the vendor process data only on your instructions, including for transfers to third countries? |
(b) Confidentiality | Are the vendor's staff bound by confidentiality? |
(c) Security under Art. 32 | Is a description of technical and organisational measures (TOMs) attached? |
(d) Sub-processors | Is there a list and a right to object to changes? |
(e) Data subject rights | Does the vendor help with access, erasure and export requests? |
(f) Art. 32 to 36 | Does it assist with breaches and impact assessments? |
(g) End of contract | Does it delete or return all data at your choice? |
(h) Evidence and audits | Does it provide information and allow audits? |
Under Article 28(9) GDPR, the contract must be in writing, including in electronic form. That is why many SaaS vendors offer their DPA as a click-through agreement or download. You can read the full text of Article 28 at gdpr-info.eu.
What should you watch for in standard DPAs?
Large vendors rarely negotiate their DPA. You can still review it and make a conscious decision. Pay particular attention to these points:
Sub-processors: Article 28(2) allows a general authorisation. The vendor must then inform you of changes so you can object. Check how it does this, for example by email or RSS.
Third countries: does the DPA state which countries receive data and on what basis? For the US, the EU-US Data Privacy Framework or standard contractual clauses are the usual options.
TOM annex: vague sentences such as “data is stored securely” are not enough. Good annexes name encryption, access controls and certifications.
Audit rights: many vendors refer to audit reports such as ISO/IEC 27001 or SOC 2 instead of on-site audits. Article 28(5) allows approved codes of conduct and certifications as an element to demonstrate sufficient guarantees.
Breach notification: when does the vendor report a breach? Article 33(2) requires notification without undue delay.
What about self-hosted software?
Self-hosting can still require a DPA. If you run open source software such as Mattermost on your own servers, the software maker is not your processor by default. That changes when a hosting provider runs the servers or external support staff can access the data. The DSK notes in its guidance on video conferencing systems that such access can exist even with self-operated systems. In that case you need a DPA with the service provider. Check your data centre, managed hosting and maintenance contracts as well.
What happens without a DPA?
A missing or incomplete DPA infringes Article 28 GDPR. The DSK points to possible fines under Article 83(4) in its short paper.
€10m
Responsibility for processing stays with you, even when a vendor carries it out. The DSK stresses that controllers cannot escape this by outsourcing. If a vendor processes data for its own purposes against your instructions, Article 28(10) treats it as a controller for that processing.
How to review a DPA in five steps
Download the vendor's DPA and TOM annex or accept it in the admin console.
Compare the content with the Article 28(3) table above.
Review the list of sub-processors and third countries.
Request or view evidence such as ISO/IEC 27001, SOC 2 or a C5 attestation.
File the DPA and record it in your record of processing activities.
This review belongs in every software selection. Our SaaS selection checklist shows where it fits. Short definitions are in the glossary under DPA and GDPR. Start with the tools that hold customer or employee data.
Frequently asked questions
Does a DPA have to be signed by hand?
Article 28(9) GDPR requires written form, including electronic form. Accepting the DPA in an admin console or concluding it electronically is therefore usually sufficient.
Do I need a DPA with my tax adviser?
Usually not. The German DSK treats professionals bound by secrecy, such as tax advisers, as independent controllers. Sharing data with them then needs a legal basis under Article 6 GDPR.
What are TOMs?
TOMs are technical and organisational measures under Article 32 GDPR, such as encryption, access controls, backups and training. A DPA usually refers to a TOM annex.
Can I change a large vendor's DPA?
Rarely. Large vendors use standard contracts. You can still check whether the minimum terms of Article 28(3) are included and choose another tool if something is missing.
Sources
- Art. 28 GDPR – Processor (text of Regulation (EU) 2016/679) , intersoft consulting
- Kurzpapier Nr. 13: Auftragsverarbeitung, Art. 28 DS-GVO , Datenschutzkonferenz (DSK) , 2018-12-17
- Orientierungshilfe Videokonferenzsysteme , Datenschutzkonferenz (DSK) , 2020-10-23
