On this page
You decide, your supplier carries out
Every time a supplier handles personal data of your customers or staff, you have to set down what it may do with it. The GDPR calls you the controller: you decide why and how the data is used. The supplier is the processor: it does the work for you. Think of the developer who hosts your site and forwards the requests from your form, the tool that sends your newsletter, or the SaaS package that holds your schedule and customer records.
Without one, nobody knows what the supplier may do with that data, how long it keeps it, who else looks at it or what happens in a breach. With one, you remain accountable, but you have on paper what your supplier commits to.
Article 28 of the GDPR
The obligation sits in article 28 of the General Data Protection Regulation, the GDPR: Regulation (EU) 2016/679 of 27 April 2016, applicable since 25 May 2018. Article 28 says you only work with processors that give sufficient guarantees, and that you set the processing out in a contract, on paper or electronically. On 4 June 2021 the European Commission published standard clauses for such a contract (Implementing Decision (EU) 2021/915), free for anyone to use. Every member state has its own supervisory authority; in Belgium it is the Data Protection Authority (GBA in Dutch), which offers, among other things, a record template for processors.
Who is who: controller, processor, sub-processor
- Data subjectYour visitorFills in your quote form: name, phone, postcode, their question.
- ProcessorYour web developerHosts the site and forwards the request, only on your documented instructions.
- Sub-processorHosting and email serviceBound by the same duties, and only with your authorisation.
Data processing agreement between you and your developer
The same duties, passed down to the sub-processor
What the agreement describes at a minimum
- Subject: hosting the site and forwarding requests
- Duration: as long as the maintenance contract runs
- Nature: storing, forwarding by email, backup
- Purpose: answering quote requests
- Type of data: name, phone, email, postcode, message
- Data subjects: visitors and customers who send a request
The contract follows the data: every link that touches it is on paper.
When you need one, and when not
As soon as a supplier stores, views, forwards or changes personal data for you, because you asked it to. Personal data is broader than people expect: a name, an email address, a phone number or an IP address is enough.
| Supplier | What it does with data | Processor? |
|---|---|---|
| Your web developer or host | Stores the site, receives and sends the requests from your form, makes backups | Yes, for everything done on your behalf |
| Your newsletter or email tool | Keeps your list and sends email in your name | Yes |
| Your scheduling, CRM or accounting software in the cloud | Holds customer and staff data on its servers | Yes, the DPA is often part of the terms |
| An outside development team with access to production | Reads and changes live data while building or fixing, for example a nearshore team | Yes, including each person brought in through staff augmentation |
| An AI tool that reads your email or customer questions | Processes the content of messages, see AI automation | Yes, and check where the data goes |
| A party that decides for itself what it does with the data | Uses it for its own purposes | No, it is a controller itself |
The last row is the line. When a supplier decides for itself why and how it uses data, it is not a processor but a controller; article 28(10) says a processor that starts deciding on its own is treated the same way. Advertising pixels and analytics often follow their own rules, covered in do I need a cookie banner?, and what Brussels wants to change there is in our piece on the digital omnibus.
Eight commitments it must hold
Article 28(3) spells it out. The agreement describes the subject and duration of the processing, its nature and purpose, the type of personal data and the categories of data subjects, and your rights and obligations. On top of that the processor makes eight commitments, a to h. Check them against your own contracts:
Your supplier's eight commitments
- a. It processes only on your documented instructions, including transfers outside the EU.
- b. Everyone at the processor with access to the data is bound to confidentiality.
- c. It takes the security measures of article 32, such as encryption and backups.
- d. It brings in no other processor without your authorisation, and passes on the same duties.
- e. It helps you when someone wants to see, correct or delete their data.
- f. It helps you with security, breaches and impact assessments.
- g. At the end it deletes or returns everything, copies included.
- h. It gives you the information to check all this and allows audits.
A German machine builder hires an outside studio
Say a German machine builder hires a Belgian studio to build a customer portal where dealers log in, order spare parts and see their invoices. The machine builder is the controller; the studio is a processor; the studio's hosting and email service are sub-processors. Before go-live they sign a DPA based on the EU standard clauses, and three points get concrete numbers. The studio reports a breach within 24 hours, so the machine builder can notify its own authority within the 72 hours of article 33. The sub-processors are named in an annex, with the region where the data is stored. And at the end of the contract the studio deletes or returns all data within 30 days.
Because both sides are in the EU, no transfer clauses are needed. If the studio had sent part of the work to a team outside the EEA, those transfer clauses would come on top. What dealers are told about their data goes into the portal's privacy policy; the encrypted connection to the portal comes from its SSL certificate. Switching cloud provider later gets easier from 2027 under the Data Act.
Usually free, and an hour of reading
The Commission's standard clauses are free, and so are the terms of large vendors. The cost is time: about an hour per supplier to find or draft the agreement, check the sub-processors and update your records. A lawyer drafting a tailored DPA charges their hourly rate. On the other side sits article 83: breaching the duties around processors can bring a fine of up to 10 million euros or 2 percent of worldwide annual turnover. If your customer falls under NIS2, they will also ask about your security; that is a separate law with its own questionnaire.
Four questions about contracts and data
Is a data processing agreement mandatory?
Yes, as soon as a supplier handles personal data for you. Article 28 of the GDPR requires a contract or other binding legal act, in writing or electronically. A verbal arrangement is not enough.
Who drafts the data processing agreement?
Either side may. Large vendors put their own text in their terms. With a smaller supplier you can propose a text; the European Commission's standard clauses of 4 June 2021 are a free and recognised starting point.
What is the difference between a DPA and a privacy policy?
A privacy policy tells your visitors and customers what you do with their data. A DPA sets out between you and your supplier what the supplier may do with that data. You usually need both.
What if my supplier is outside the EU?
Then besides the DPA you need a legal basis for the transfer, such as the EU standard contractual clauses for transfers. Large vendors such as AWS build them into their terms; with a smaller supplier, ask for them.