Can a DPA be part of the main contract?

Yes, a DPA can be an annex or integral part of a service agreement. What matters is that it clearly meets the requirements of Art. 28 GDPR.

What are sub-processors?

A sub-processor is an additional vendor that your processor engages in the processing (e.g. cloud hosting). The DPA must define conditions for engaging sub-processors.

How long must I retain a DPA?

The DPA must be available throughout the contract term and for at least 5 years after its end, as evidence of GDPR compliance.

Must I have a DPA with all vendors?

Only with those who process personal data on your behalf (processors). Vendors who merely receive payments or deliver goods without access to personal data do not require a DPA.

Compliance & Legal

Data Processing Agreement (DPA)

GDPR DPA — Data Processor Agreement

The mandatory agreement for anyone processing data on behalf of another company.

Start free Features

GDPR compliant · EU-hosted

85 % of companies lack a DPA with at least one of their vendors

A fine for a missing DPA can reach €10 million or 2 % of annual turnover

Regulators open 40 % of proceedings precisely because of missing or incorrect DPAs

A DPA under Art. 28 GDPR — defines purpose, scope, security measures and the processor's liability. AI tailors it to the specific vendor (cloud, marketing, payroll).

Legal context

A DPA is mandatory under Art. 28 GDPR (Regulation 2016/679/EU) for any relationship where a processor handles personal data on behalf of a controller. Without a DPA, the fine can reach €10 million or 2 % of annual turnover.

GDPR Regulation 2016/679/EU Art. 28 — data processing agreement; fine up to €10 million or 2 % of turnover

Legal basis & glossary

When to use a Data Processing Agreement (DPA)

When contracting with a cloud provider (AWS, Google, Microsoft)
Before sharing customer data with a marketing agency
When outsourcing payroll or accounting
When your IT vendor has access to customer personal data

What you get

Art. 28 GDPR compliance
Security measures
Sub-processors
Audit and liability

How it works

From idea to signature

Art. 28 GDPR compliance

Security measures

Sub-processors

FAQ

Frequently asked questions about Data Processing Agreement (DPA)

Whenever an external company processes personal data of your customers or employees on your behalf. Typically: cloud providers, marketing platforms, payroll software or IT admins.