Many companies outsource data processing: to cloud providers, data centers, IT service providers, or newsletter services. Responsibility for the data remains with the client, which the GDPR calls the controller. The service provider is the processor and may use the data only for the purposes and on the instructions of the controller.
The legal basis is Art. 28 GDPR. In German-speaking countries, the required contract is often called Auftragsverarbeitungsvertrag (AVV); internationally, it is known as a data processing agreement (DPA).
How the data processing agreement is regulated
Before a service provider processes personal data, both parties conclude a contract, which can exist in writing or in electronic form. Art. 28 sets out minimum contents, including:
- subject matter, duration, nature, and purpose of the processing, as well as the types of data and categories of data subjects
- processing only on documented instructions from the controller
- a confidentiality obligation for the persons involved
- appropriate technical and organizational measures
- use of further processors (subcontractors) only with authorization
- support with data subject rights and personal data breaches
- deletion or return of the data after the contract ends, as well as rights to evidence and audits
Large providers usually offer standardized contracts that are part of their terms and conditions.
Typical examples
- A company uses a cloud service for email and file storage.
- An IT service provider manages servers and can access customer data in the process, for example via Remote Support.
- An agency sends the newsletter using the company's address list.
- An AI service processes texts that contain personal data.
What companies should keep in mind
- Keep an overview of all service providers with access to personal data and check whether a contract is in place for each.
- Read the service provider's described safeguards instead of simply filing the contract.
- Check subcontractors and their locations, especially for transfers outside the EEA, see also Data Residency.
- Define rules for the end of the contract so that data is verifiably deleted or returned.
How it differs
Not every collaboration requires a DPA. If a partner decides on the purposes and means of processing itself, it is an independent controller, for example a bank handling payments or a law firm handling a client matter. If two parties jointly determine the purposes and means, the GDPR speaks of joint controllership under Art. 26.
This entry is a general overview and does not replace legal advice.