A data processing agreement is the contract Article 28 of the GDPR requires between a controller and a processor. If you sell software that handles your customers' personal data, you sign one with almost every customer. If you buy software that handles yours, you sign one with almost every vendor.
Because DPAs are everywhere, they get treated as boilerplate. That fails in both directions. Customers sign vendor DPAs that omit required terms. Vendors accept customer DPAs with breach and audit clauses they cannot operate.
This article lists what Article 28 requires, explains what each term means operationally, and covers the points that get negotiated.
When you need one
Article 28(3) requires processing by a processor to be governed by a contract or other legal act that binds the processor to the controller. Article 28(9) requires it to be in writing, which includes electronic form.
The trigger is the relationship, not the volume of data. If one party processes personal data on behalf of another, on its instructions, you need a DPA. Whether you are a controller or a processor for a given activity is a question of fact. The GDPR attaches consequences to getting it wrong: under Article 28(10), a processor that determines the purposes and means of processing is treated as a controller for that processing.
Where both parties are independent controllers, a DPA is the wrong instrument. Where they jointly determine purposes and means, Article 26 requires an arrangement between joint controllers instead.
The descriptive terms
Article 28(3) first requires the contract to set out:
the subject matter and duration of the processing,
the nature and purpose of the processing,
the type of personal data and the categories of data subjects, and
the obligations and rights of the controller.
These usually sit in an annex. Write them specifically. "Customer data" as the type of data and "users" as the data subjects tells nobody anything, and it will not match the processor's Article 30 record, which needs the same information.
The eight processor obligations
Article 28(3)(a) to (h) then require the contract to oblige the processor to do eight things. Each has an operational consequence.
Process only on documented instructions (a), including with regard to international transfers, unless EU or Member State law requires otherwise. In that case the processor informs the controller of the requirement before processing, unless the law prohibits it. The DPA and the service agreement together are usually the documented instructions, so say so.
Ensure confidentiality (b): people authorized to process the data are committed to confidentiality or under a statutory duty. In practice, confidentiality terms in employment and contractor agreements.
Take the security measures required by Article 32 (c). Most DPAs attach a security annex. That annex becomes a commitment, so it should describe controls you operate, not controls you intend to build.
Respect the conditions for engaging sub-processors (d) in Article 28(2) and (4): prior specific or general written authorization, notice of intended changes with an opportunity to object, and the same data protection obligations flowed down by contract. The initial processor remains fully liable to the controller for a sub-processor's performance.
Assist with data subject rights (e), through appropriate technical and organizational measures, insofar as this is possible.
Assist with the controller's obligations under Articles 32 to 36 (f): security, breach notification, DPIAs, and prior consultation, taking into account the nature of processing and the information available to the processor.
Delete or return all personal data at the end of the services (g), at the controller's choice, and delete existing copies unless EU or Member State law requires storage.
Make available all information necessary to demonstrate compliance (h), and allow for and contribute to audits, including inspections, by the controller or an auditor it mandates.
Article 28(3) also requires the processor to inform the controller immediately if, in its opinion, an instruction infringes the GDPR or other data protection law. Decide who in your organization makes that call, and how an engineer who spots a problem reaches them, so the obligation can be met in practice.
Terms the regulation leaves open
Article 28 sets the floor. Most negotiation happens over points it does not fix.
Breach notice timing
Article 33(2) requires a processor to notify the controller "without undue delay" after becoming aware of a personal data breach. Controllers often ask for a fixed number of hours instead, because their own 72-hour clock depends on hearing from you. As a processor, commit only to a period your incident process can meet, measured from a defined trigger, such as confirmation of a breach affecting that customer's data.
Audit rights
Point (h) requires the processor to allow for and contribute to audits. Processors usually offer independent assurance, such as a SOC 2 report or an ISO 27001 certificate, as the primary means. They then limit on-site audits to cases where the reports do not answer the controller's question, with notice and at the controller's cost. A clause that excludes audits entirely sits badly with point (h). Draft it to allow an audit where the reports are not enough.
Sub-processor notice
General authorization is the norm for SaaS, because a product with many customers cannot seek specific approval from each one for each new vendor. The negotiation is over how notice is given, how long the notice period is, and what happens on objection. The usual mechanics are a published list, a subscription for change notices, and a right to terminate the affected service if an objection cannot be resolved.
Deletion and return
Specify the format of a return, the deadline for deletion after termination, and how backups are handled. Backups usually expire on their own retention cycle rather than being purged on request. Say so in the DPA, and state the cycle.
Liability
Article 82 governs liability to data subjects. The allocation between the parties, including any cap on data protection claims, is a commercial term the GDPR does not set. It is often the hardest point to agree.
International transfers
If personal data leaves the EEA under the DPA, the transfer needs its own mechanism, most often the Commission's standard contractual clauses for international transfers. These are usually incorporated into the DPA by reference, with the annexes completed.
Reviewing a DPA: a checklist
Whether you are signing a vendor's DPA or reviewing a customer's, check that:
the descriptive annex names real data categories and data subjects,
all eight Article 28(3) obligations are present, plus the duty to flag infringing instructions,
the security annex matches controls that are actually operating,
sub-processor terms state the type of authorization, the notice method, and the objection process,
the breach notice period and its trigger are ones the processor can meet,
the audit clause allows audits and says how reports are used,
deletion and return terms cover format, deadline, and backups,
a transfer mechanism is attached or incorporated where data leaves the EEA, and
the order of precedence between the DPA, the main agreement, and any transfer clauses is stated.
The last item causes quiet problems. If the main agreement caps liability and the DPA says it prevails on data protection matters, you need to know which provision wins before a claim, not after.
For processors, check that every obligation you accept can be operated. A clause promising to assist with each data subject request within a short period commits your support team, not your lawyers. The ISO 27701 controller and processor controls are a useful map of what operating these obligations looks like day to day.
Article 28 itself is settled, but how individual terms are read can vary with national guidance and the governing contract law. Confirm material deviations from your standard position with counsel.
How TrustLynce helps
TrustLynce's third-party risk management tracks which vendors process personal data, whether a DPA is in place, and when each vendor is due for reassessment. Customer commitments records the breach notice and audit terms you agree to in customer DPAs and maps each one to the control that delivers it.