A Data Processing Agreement is not optional paperwork — it is a legal requirement under GDPR Article 28 every time a third party processes personal data on your behalf. Yet when supervisory authorities audit small and medium businesses, missing DPAs are among the most common findings. Understanding when you need one, what it must contain, and how to obtain it from vendors is a basic compliance obligation.
Controller vs Processor: The Distinction That Triggers the DPA Requirement
Before determining whether you need a DPA, you need to understand the two roles GDPR defines.
A data controller is the entity that determines the purposes and means of processing personal data — in other words, it decides why data is collected and how it is used. If you run a website and collect email addresses for your newsletter, you are the controller for that data.
A data processor is an entity that processes personal data on behalf of a controller, according to the controller's instructions. The processor does not decide why the data is collected or how it is used — it simply acts on the controller's directions.
Common examples:
- You are the controller; Mailchimp is the processor (it sends emails on your instructions)
- You are the controller; Google Analytics is the processor (it analyses your users' behaviour on your behalf)
- You are the controller; AWS or DigitalOcean is the processor (it stores your database on your servers)
The moment this controller–processor relationship exists, GDPR Article 28(3) requires a written contract — the DPA.
The 10 Mandatory Clauses Under Article 28(3)
A GDPR-compliant DPA must include all of the following. A DPA that omits any of these elements is non-compliant, even if both parties have signed it.
- Subject-matter and duration — what data is being processed and for how long
- Nature and purpose of processing — what operations are performed (storage, transmission, analysis) and why
- Type of personal data and categories of data subjects — e.g. email addresses and names of newsletter subscribers
- Obligations and rights of the controller — confirmation that the processor acts only on documented instructions
- Sub-processor restrictions — processor must not engage another processor without prior written authorisation; sub-processors must be bound by equivalent obligations
- Technical and organisational security measures — reference to Article 32 obligations (encryption, pseudonymisation, access controls, resilience)
- Assistance with data subject rights — processor must help the controller respond to access, erasure, and portability requests
- Breach notification — processor must notify the controller without undue delay after discovering a breach; the controller has 72 hours to notify its supervisory authority under Article 33
- Deletion or return on termination — at the end of the contract, the processor must delete or return all personal data at the controller's choice
- Audit rights — controller has the right to conduct audits or inspections; processor must make all necessary information available to demonstrate compliance
Tools That Require a DPA
The list is longer than most businesses realise. Any cloud tool with access to personal data relating to your users, customers, or employees falls within scope.
| Tool / Platform | DPA Required? | Where to Find It | Sub-processor Concern |
|---|---|---|---|
| Mailchimp | Yes | Legal Centre → Data Processing Addendum | Meta Pixel, Mandrill |
| Google Analytics (GA4) | Yes | Google Account → Data Processing Terms | Google US servers |
| HubSpot | Yes | Customer Terms portal | Multiple US sub-processors |
| Shopify | Yes | Partner Data Processing Agreement | Shopify US, CDN providers |
| AWS | Yes | AWS Service Terms (automatically incorporated) | 100+ AWS sub-services |
| DigitalOcean | Yes | DigitalOcean DPA (available in dashboard) | Data centre operators |
| Zoom | Yes | Zoom Privacy Centre → DPA | Zoom US infrastructure |
| Slack | Yes | Slack Privacy → DPA | Salesforce (US) |
| Calendly | Yes | Calendly Legal → DPA | Google, AWS |
| Stripe | Yes (for customer payment data) | Stripe Legal → Data Processing Agreement | Card networks, banks |
| Intercom | Yes | Intercom Terms → DPA | US cloud providers |
| Typeform | Yes | Typeform Legal → DPA | Google Cloud |
How to Get a DPA From Your Vendors
Step 1: Check the vendor's legal or privacy centre. Nearly all major SaaS providers maintain publicly accessible DPA documents. Search "[vendor name] data processing agreement" — the result is usually a PDF or an online acceptance flow.
Step 2: Accept or countersign the document. Many vendors use click-through acceptance (Google, AWS, Mailchimp). Others require a wet or electronic signature. Note the date and version of the DPA you accepted.
Step 3: Review sub-processors. Every DPA should include or link to a sub-processor list. You are technically providing general or specific prior authorisation to those sub-processors when you accept the DPA. Review this list and note any transfers outside the EU/EEA that would also require SCCs.
Step 4: Record it in your processing register. Your Article 30 record of processing activities should note which processor is used, the DPA reference, and the date it was executed.
DPA vs SCCs: Two Different Obligations
These documents address different compliance problems and you frequently need both.
| Document | Purpose | Legal Basis | When Required |
|---|---|---|---|
| Data Processing Agreement (DPA) | Governs controller–processor relationship | Art. 28 GDPR | Any time a processor accesses personal data on your behalf |
| Standard Contractual Clauses (SCCs) | Authorises transfer of personal data outside EU/EEA | Art. 46(2)(c) GDPR | Any transfer to a country without EU adequacy decision (US, India, etc.) |
Using Mailchimp (a US company) requires both a DPA and a reference to SCCs (the EU–US Data Privacy Framework, or SCCs incorporated into the DPA itself). Mailchimp's standard DPA already incorporates SCCs — but you should verify the version and confirm they reference the 2021 SCCs issued by the European Commission.
What Fines Look Like Without a DPA
Supervisory authorities have cited missing or inadequate DPAs in major enforcement actions. Meta's landmark €1.2 billion fine by the Irish DPC in 2023 included findings about inadequate contractual protections for data transfers — a related failure of the same Article 28 framework. The Austrian DPA fined a business for using Google Analytics without a DPA in place. The Italian Garante has cited missing DPAs in cases against analytics providers.
Under GDPR Article 83(4), infringements of Article 28 processor obligations carry fines of up to €10 million or 2% of global annual turnover, whichever is higher. For individual data transfers found to have no lawful basis as a result, the Article 83(5) scale applies: up to €20 million or 4% of global annual turnover.
Your DPA Checklist
- Identify every third-party tool with access to personal data of your EU users
- For each tool, locate and accept or sign the DPA
- Verify the DPA includes all 10 Article 28(3) mandatory clauses
- Note the date, version, and acceptance method for each DPA
- Review sub-processor lists and check for non-EU transfers
- Confirm SCCs are in place where processors are based outside the EU/EEA
- Record everything in your Article 30 processing register
- Set a calendar reminder to review DPAs annually or when vendors update their terms
Generate a GDPR-compliant privacy policy that correctly identifies your processors and documents your legal bases for each category of processing at /gdpr-privacy-policy-generator.