Data processing agreement — DPA

An accountant, cloud provider or agency may process data on the client’s behalf for certain services but act as an independent controller for its own obligations. Sometimes parties jointly determine purposes and become joint controllers, making Article 26 rather than a standard DPA the main reference.

Roles must be mapped for each activity. The same company may have different roles for hosting, aggregated analysis, fraud prevention and its own marketing.

The agreement must describe the subject matter, duration, nature, purpose, data types, categories of individuals and controller rights, then include Article 28 obligations.

• Instructions: documented and applicable to the actual service.
• Confidentiality: authorised persons and access control.
• Security: specific technical and organisational measures, subject to controlled updates.
• Subprocessors: authorisation, list, change notification and equivalent obligations.
• Assistance: requests, DPIA, prior consultation and incidents.
• End of service: return or deletion, statutory exceptions and evidence.
• Audit: information, reports, certifications and proportionate inspections.

The security schedule must match the product: authentication, encryption, backup, customer segregation, logs, vulnerabilities and continuity. Vague promises are difficult to audit, while rigid lists can become outdated.

Liability limitations in the main agreement must align with GDPR obligations. An inter-party clause does not remove individuals’ rights or the authority’s powers but may allocate costs and internal indemnification mechanisms.

The controller must use suppliers providing sufficient guarantees. Assessment may combine security responses, independent audits, certifications, incident history and architecture documentation.

Subprocessor lists, data locations and service functions change. The agreement must create a notification and objection mechanism, while the internal team must actually monitor risky changes.