TOOLBOX · DOWNLOAD
Data processingagreement as atemplate to adapt.
If you have a service provider process personal data, Art. 28 GDPR requires an agreement that governs the subject matter, instructions, security, sub-processors, assistance and deletion. This template implements the mandatory content in twelve sections with placeholders, adds the recommendations of the European Data Protection Board from Guidelines 07/2020 and explains when the European Commission’s standard contractual clauses are the better choice. The review checklist helps you check an agreement presented by a service provider for gaps in a short time.
Free PDF · Template
Data Processing Agreement (DPA): Template Under Art. 28 GDPR with Review Checklist
- Topic
- NIS2 & Compliance
- Format
- PDF, A4
- Length
- 9 pages
- Size
- 109 KB
- Updated
- Oct 25, 2026
- Sources
- 5
- Usage
- Adaptation for your own use permitted; redistribute unchanged
WHO IT IS FOR
Who This
Is for.
Template with twelve sections and four annexes, backed by Art. 28 GDPR, EDPB Guidelines 07/2020 and Implementing Decision (EU) 2021/915.
- Management and purchasing teams that engage service providers with access to personal data
- Those responsible for data protection and data protection officers
- IT service providers, hosting and cloud providers acting as processors
- Legal advisors looking for a starting text for negotiations
7 SECTIONS
What Is
Inside.
- 01
When you need a data processing agreement
The service provider’s role, the form of the agreement and the two options: your own agreement or the European Commission’s standard contractual clauses.
- 02
Mandatory content and where it appears in the template
What Art. 28(3) GDPR strictly requires, with the section of this template that covers it.
- 03
Sample text, part 1: subject matter, instructions, security
§ 1 to § 5 to adopt and adapt; square brackets are placeholders or choices.
- 04
Sample text, part 2: assistance, audits, termination
§ 6 to § 12: data subject rights, data breaches, third countries, evidence, deletion, violations and final provisions.
- 05
Annexes to fill in
Description of the processing, technical and organizational measures, sub-processors and contacts.
- 06
Review checklist for a data processing agreement presented to you
Many service providers present their own agreements; these points show quickly whether anything is missing.
- 07
Common mistakes
What weakens data processing agreements in practice and how to avoid it.
EXCERPT
Mandatory content and where it appears in the template
| Mandatory content | Reference | Template |
|---|---|---|
| Subject matter and duration, nature and purpose, type of data, categories of data subjects, obligations and rights of the controller | Art. 28(3), first sentence | § 1, § 2, § 9, Annex 1 |
| Processing only on documented instructions, including for third-country transfers; notice in case of an instruction that infringes data protection law | Art. 28(3)(a), second subparagraph | § 2, § 8 |
| Confidentiality of authorized persons | Art. 28(3)(b) | § 3 |
| All measures required under Art. 32 | Art. 28(3)(c) | § 4, Annex 2 |
| Conditions for sub-processors: authorization, information, objection, same obligations | Art. 28(2), (3)(d) and (4) | § 5, Annex 3 |
| Assistance with data subject requests | Art. 28(3)(e) | § 6 |
| Assistance with security, breach notification, impact assessment, consultation (Art. 32 to 36) | Art. 28(3)(f) | § 7 |
| Deletion or return at the controller’s choice, deletion of existing copies | Art. 28(3)(g) | § 10 |
| Evidence, audits and inspections | Art. 28(3)(h) | § 9 |
SOURCES
Supported
by Sources.
- Regulation (EU) 2016/679 (GDPR), corrigendum OJ L 127 of May 23, 2018 (opens in a new tab)Art. 26, 28, 29, 32, 33(3), 45, 46, 82 and Chapter V; Art. 28(3)(g) in the corrected version
- Implementing Decision (EU) 2021/915: standard contractual clauses under Art. 28(7) GDPR (opens in a new tab)Art. 1 and 2, Recitals 5 and 6, Clauses 2, 7, 8, 9 and 10, Annexes I to IV
- Implementing Decision (EU) 2021/914: standard contractual clauses for third countries (opens in a new tab)Art. 1(1): safeguards under Art. 46(2)(c) GDPR
- EDPB Guidelines 07/2020 on the concepts of controller and processor (opens in a new tab)Version 2.0 of July 7, 2021, paras. 12, 39 f., 104 to 159
- Digital Omnibus proposal COM(2025) 837, procedure 2025/0360(COD) (opens in a new tab)reviewed: no amendment to Art. 28 GDPR proposed; pending as of October 25, 2026
TOMORIS template, not an official text: it must be adapted to the specific processing, the main agreement and your company. It provides an overview and does not replace legal advice; the text of the law in its current version is decisive.
TOOLBOX
Explore
Further.
Data processing agreement (DPA)
When a service provider processes data on your behalf and what the agreement must contain, explained in the glossary.
Learn MoreTechnical and organizational measures
Which safeguards Art. 32 GDPR requires for the security of personal data, explained in the glossary.
Learn MoreGDPR
What the General Data Protection Regulation governs and which obligations it creates for companies, explained in the glossary.
Learn More
NIS2 & COMPLIANCE
More on
This Topic.
- PDF
NIS2 Reporting Obligations
Early warning within 24 hours, notification within 72 hours, final report after one month: deadlines, content, and recipients with references to the NISG 2026, plus a checklist.
View - PDF
NIS2 Incident Report
A worksheet for emergencies: master data, a significance checklist under the NISV 2026, fields for the early warning, notification, and final report, customer information, a GDPR review, and a log.
View - PDF
GDPR Data Breach Checklist
Data breach detected, now what? Establish the breach, assess the risk, notify the Austrian Data Protection Authority (Datenschutzbehörde) on time, inform data subjects and document everything, under Art. 33 and 34 GDPR.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.