Free Data Processing Agreement Generator

A DPA is needed whenever you transfer personal data to a service provider that acts under your instructions for the specific purposes you have defined – what is called a processor. The same need appears if your company acts as a service provider for another company.  

Under the EU-GDPR, there are certain topics that need to be covered. These are defined in Art. 28 EU-GDPR and include the purpose, duration, and nature of the processing, the need for the processor’s employee and staff to be under a duty of confidentiality, and the processor’s obligation to only act under the instructions of the controller, assist the controller in complying with data subjects’ rights request, the security of the personal data and, in general, with the obligations enshrined in the EU-GDPR.  

It can, but it needs to obtain the authorisation from the controller, as defined in the DPA. This can be done on a case-by-case basis, where the processor requests the authorisation from the controller every time they want to engage with a new sub-processor. It can also be done with a general authorisation included in the DPA, where the controller allows the processor to engage with new sub-processors for the future. 

In certain cases, personal data is not transferred to a processor (meaning a service provider that acts under the instructions of the controller), but to another company that, jointly with yours, also determines the purposes and means of the processing. In these cases and under the EU-GDPR, this relationship also needs to be governed by a contract, where the joint controllers determine their respective responsibilities and, in particular, how they will comply with data subjects’ rights and how they will provide the appropriate privacy notices to them.