Data Processing Agreement

Once an outside provider processes personal data on a company's behalf, say a cloud provider storing camera footage or an IT vendor with remote access to systems, GDPR requires a dedicated contract for that. This Data Processing Agreement sets out what the data may be used for, which technical and organisational measures apply, and what happens to the data once the contract ends. The provider is only allowed to act on the documented instructions of the controller, not decide independently what to do with the data.

In practice, a DPA is usually a separate document alongside the actual supply or service contract, and it typically covers confidentiality, sub-processors, breach notification duties, and deletion once the contract ends. Many software vendors offer standardized templates for this, which still need to be reviewed and adapted to the actual situation. If no such agreement exists at all despite personal data being processed on the company's behalf, that's an open point both technically and organisationally.

An edge case that often gets missed: not every service provider automatically counts as a processor. Anyone who independently decides the purpose and means of processing counts as a controller in their own right and needs a different contractual basis. Whether a DPA is required in a given case, and exactly how it should be worded, is a legal question that should be worked out with proper legal counsel.