A DPA Governs What a Vendor May Do With Your Data
A data processing agreement is a contract term, not a security review. If you hand personal data to a vendor covered by GDPR, Article 28 requires one. It dictates six things the contract must specify and eight duties the processor takes on.
A vendor with an immaculate security posture can still hand you a DPA permitting uses you would never agree to. Article 28 sits in the fine tier of Article 83 paragraph 4, reaching 10,000,000 euro or 2% of total worldwide annual turnover, whichever is higher.
Read the DPA for permissions and the security report for controls. They answer different questions and neither substitutes for the other.
The Six Things a DPA Has to Pin Down
- ● Subject matter and duration
- ● Nature and purpose of processing
- ● Data types and data subjects
Article 28 names the terms a contract must specify. They are the subject matter and duration of the processing, the nature and purpose of it, and the type of personal data involved. The list closes with the categories of data subjects and the obligations and rights of the controller.
Those read like boilerplate until you check a real agreement against them. A DPA describing purpose as providing the services is technically present and practically empty.
The type of personal data clause is the one worth arguing over. A precise list constrains what the vendor may hold, while a phrase like customer data as submitted constrains nothing at all.
Duration matters for the same reason. An open-ended term paired with a vague deletion clause means data can sit on a vendor system long after you stop paying for the product.
The Eight Duties the Processor Signs Up To
Paragraph 3 lists lettered obligations from a through h. The processor must act only on documented instructions from you, including for international transfers, unless law requires otherwise.
It must ensure staff are bound by confidentiality or an appropriate statutory obligation, and implement the security measures required by Article 32. It must meet the sub-processor conditions set in paragraphs 2 and 4.
It must assist you with data subject rights requests under Chapter III, and help you meet the obligations in Articles 32 to 36. Those two together cover breach notification and impact assessments.
Finally it must delete or return the personal data when the services end, unless law requires retention, and provide the information needed to demonstrate compliance and allow audits.
Sub-Processors Are Where Small Buyers Get Surprised
- ● Written authorisation required
- ● Changes must be announced
- ● You keep a right to object
A processor cannot bring in a sub-processor without prior specific or general written authorisation. Most vendors take the general route, publishing a list and asking you to accept future additions.
That route comes with a condition. Under general authorisation the processor must inform you of any intended changes to its sub-processors, so you have the opportunity to object.
Check where that notice actually goes. A clause satisfied by updating a web page you have never visited is compliant in form and useless in practice. Look for email notification with a stated notice period instead.
The list itself is worth reading once. A tool you bought for one purpose may sit on top of four other vendors, each holding the same personal data you were careful about.
Reading a Vendor DPA Against the Requirement
Each row names a clause and what a weak version looks like. Compare against the agreement a vendor actually sends rather than the summary on its trust page.
| Clause | What Article 28 requires | A strong version reads | A weak version reads | Why the difference bites |
|---|---|---|---|---|
| Purpose of processing | Nature and purpose stated in the contract | Named purposes tied to specific product features | To provide and improve the services | Improve can cover analytics and model training |
| Data types | The type of personal data specified | An enumerated list by category | Any data submitted by the customer | Nothing constrains what may be collected |
| Instructions | Processing only on documented instructions | Instructions defined as the agreement plus written requests | Instructions deemed given by using the product | Removes your ability to say no in writing |
| Sub-processors | Prior specific or general written authorisation | Email notice with a stated objection window | Website list updated at the vendor discretion | You never learn a new party holds the data |
| Deletion and return | Delete or return at the end of services | Deletion within a stated number of days, on request | Deleted in accordance with our retention policy | The policy can change without your agreement |
| Audits | Provide information and allow audits | Annual audit right plus report access on request | Audit satisfied solely by a certification summary | You cannot verify anything independently |
Requirements are drawn from GDPR Article 28 as of Aug 2026. Confirm the current text on the official regulation source, and take legal advice for your own contracts rather than relying on a summary.
The pattern is consistent across weak agreements. Each clause exists, each one technically references the requirement, and each one moves the actual decision to the vendor.
Controller and Processor Are Roles, Not Job Titles
The words describe what a party decides, not what it sells. A controller determines the purposes and means of processing, while a processor acts on the controller behalf.
The same company can be both, in different relationships. Your email platform is your processor for your subscriber list, and its own controller for the account data it holds about you.
Watch for the moment a vendor steps out of the processor role. A tool that starts using your data for its own purposes has become a controller for that activity, and Article 28 no longer describes the relationship.
Documented instructions are the boundary marker. A processor acting only on your instructions stays a processor, and a clause letting it decide new purposes quietly moves that line.
That is worth rechecking whenever a product adds features. Analytics, benchmarking and personalisation modules all involve a vendor deciding something new about data you supplied.
Where a DPA Meets the AI Features You Just Enabled
The documented instructions clause is doing heavy work in modern agreements. A processor may act only on documented instructions, so any new use of your data has to fit inside what you instructed.
Training a model on customer content is a new use by any reasonable reading. Whether the agreement permits it depends entirely on how purpose and instructions were drafted.
Vendors handle this in three broad ways. Some exclude training outright, some allow it with an opt-out buried in settings, and some describe it as service improvement without naming it.
The third version is the one to push back on. Improve the services is exactly the phrase that turns a specific purpose clause into a general permission.
Ask for the position in writing rather than inferring it from a marketing page. A line in the agreement outlasts any statement on a website that can be edited overnight.
A DPA Is Not a SOC 2 Report
- ● SOC 2 - how they protect data
- ● DPA - what they may do with it
- ● One does not replace the other
The two documents answer different questions. A security attestation describes how a provider protects data, while a DPA describes what the provider is permitted to do with it.
That gap is where uncomfortable surprises live. Training a model on customer content, or enriching a contact list with third party data, is a permissions question and no security report will flag it.
Our explainer on what SOC 2 compliance means for small business software covers the attestation side in detail. Read both documents for any vendor holding customer records.
Ask for both at the same point in the process too. Requesting them during evaluation, as covered in how to evaluate a SaaS tool during a free trial, is far easier than renegotiating after rollout.
When Signing One Actually Becomes Necessary
The trigger is the role, not the size of the company. If you decide why and how personal data gets processed, you are the controller. Any vendor processing it on your behalf is a processor, and that pairing needs a contract under Article 28.
Scope follows the data rather than your address. A small agency handling personal data of people in the European Union sits inside the regime, and the United Kingdom runs its own version of the same rules.
Several United States state privacy laws impose their own contract requirements on service providers. Those terms differ from Article 28, so a European DPA does not automatically satisfy them.
The practical upshot is that most business software purchases need one. Anything touching employees, customers, subscribers or applicants is carrying personal data by definition.
Which DPA Step Fits Your Business
Match the effort to what you actually process. Not every purchase deserves the same scrutiny.
Solo operators using mainstream tools: Accept the standard DPA but read the sub-processor clause and the deletion terms. Those two decide what happens to your client data when you leave.
Small teams with European customers: Ask for the DPA in writing before signing the order form. Check that purpose is described in product terms rather than as improving the services.
Anyone feeding customer content into AI features: Read the instructions clause and any training carve-out closely. This is the single clause where standard agreements vary most between vendors.
Teams inheriting an existing stack: Collect the agreements you already have and match them to live tools. The subscription review in auditing SaaS subscriptions and wasted seats is the natural time to do it.
Anyone leaving a vendor: Trigger the deletion or return clause explicitly and in writing. Our guide to cancelling a SaaS contract before auto renewal covers the timing that makes the request enforceable.
What to Ask For Before You Sign the Order Form
Ask for the DPA before the contract, not after. Vendors negotiate far more willingly while a purchase is pending than once the invoice is paid.
Then read four clauses rather than the whole document. Purpose, data types, sub-processors and deletion carry almost all the practical risk, and each one takes a minute to check against the list above.
Keep the signed copy somewhere you can find it. The value of a DPA arrives on the day something goes wrong, which is never the day you have time to hunt for it. A DPA also matters when the company on the other side of it changes owners. Our guide to what happens when a SaaS vendor gets acquired explains which clauses survive a sale and when to re-check the sub-processor list.
FAQ
What is a DPA in software contracts?
A data processing agreement is the contract that sets what a vendor may do with personal data you hand over. GDPR Article 28 requires one whenever a processor handles personal data on a controller behalf, and it lists the terms that contract must contain.
Does a small business really need a DPA?
If you hand personal data to a vendor and that data falls under GDPR, yes. The obligation follows the role rather than headcount or revenue, so a two person agency using a European mailing list is in scope.
Is a DPA the same as a SOC 2 report?
No. SOC 2 is an attestation about how a provider protects data, while a DPA is a contract about what the provider may legally do with it. A vendor can hold a clean SOC 2 report and still offer a DPA that permits uses you would refuse.
Can a vendor add sub-processors without telling me?
Under Article 28 paragraph 2 the processor needs prior specific or general written authorisation. With general authorisation it must tell you about intended changes to its sub-processors so you have the chance to object.
What happens if there is no DPA in place?
Article 28 sits inside the tier of GDPR Article 83 paragraph 4, which allows administrative fines up to 10,000,000 euro or 2 percent of total worldwide annual turnover, whichever is higher. The higher tier reaching 20,000,000 euro or 4 percent covers other articles.
Sources
- Data controller or data processor | Data protection guide for small business | European Data Protection Board — checked 2026-10-01
Some links may be affiliate links. We may earn a commission at no extra cost to you.
How this article was made: it was drafted with AI assistance from the official sources listed above, and its figures were checked against those pages on the dates shown. It is not based on personal hands-on testing.
Comments
Post a Comment