Purpose
Anyone who has personal data processed by a service provider (cloud, payroll accounting, IT maintenance, marketing) needs a data processing agreement (DPA) under Art. 28 GDPR. The special feature: A missing or defective DPA is itself a separate infringement subject to a fine – regardless of whether a data breach ever occurs. If one of the mandatory clauses of Art. 28(3)(a)–(h) is missing, the contract is incomplete and the processing on behalf is formally unlawful. This skill reviews roles, mandatory clauses, sub-processors, technical and organisational measures as well as – in the case of professional secrecy holders – the additional protection under Section 203 of the German Criminal Code (StGB) and produces a concrete list of deficiencies.
Inputs
- Contract text (DPA draft or signed version)
- Roles: Who is the controller, who is the processor? (possibly multi-level)
- Professional secrecy holder yes/no (lawyer, tax advisor, physician, notary)
- Sub-processors engaged (known / planned / list available?)
- Third-country nexus (server location, group parent company, support from a third country)
- Annexes: TOM description (Art. 32), subcontractor list, authorisation regime
Sub-agent architecture
The review runs in three roles that work one after the other:
- Researcher – reads the contract text and the annexes, assigns each clause to the statutory requirements of Art. 28(3)(a)–(h) and collects open points. Clarifies the third-country nexus and the subcontractors actually engaged.
- Drafter – formulates a concrete proposal for improvement for each missing or weak clause and drafts the list of deficiencies with priority.
- Reviewer – checks for completeness (are all (a)–(h) covered?), reviews the incorporation of Section 203 StGB in the case of professional secrecy holders and assesses the liability and fine risk. No invented clause numbers, no invented case law.
Process
1. Clarification of roles
First determine who is the controller and who is the processor . Genuine processing on behalf exists only if the service provider acts on instructions and without its own discretion over purposes and means. If the service provider decides on purposes itself (e.g. its own analysis), there is no processing on behalf but its own responsibility or joint responsibility (Art. 26 GDPR) – in that case a DPA is the wrong instrument. In multi-level chains, classify each level separately.
2. Checklist of mandatory clauses (Art. 28(3)(a)–(h) GDPR)
The DPA must be a binding contract and contain all mandatory clauses of Art. 28(3) GDPR . Check off each of the following (a)–(h) individually:
- (a) – Binding instructions: Processing only on documented instructions from the controller, including third-country transfers.
- lit. b – Confidentiality: Obligation of persons authorized to process data to maintain confidentiality.
- lit. c – Security: Implementation of all measures pursuant to Art. 32 GDPR (see Step 4).
- lit. d – Subprocessors: Compliance with the conditions under Art. 28(2) and (4) (see Step 3).
- lit. e – Data subject rights: Support of the controller with requests from data subjects (Chapter III GDPR).
- lit. f – Support Art. 32–36: Assistance with security, reporting of data breaches and data protection impact assessment.
- lit. g – Deletion/return: at the controller's choice, deletion or return of all data after the end of processing.
- lit. h – Evidence/audits: Provision of all required information and enabling of reviews/audits.
Any missing or only apparently regulated item is a missing mandatory clause and goes into the list of defects.
3. Subprocessor regime + third country
- Authorization (Art. 28(2) GDPR): No subprocessor without the prior specific or general written authorization of the controller. In the case of general authorization, the DPA must provide for a right to information and objection in the event of a change/addition.
- Passing on of obligations (Art. 28(4) GDPR): The same data protection obligations must be imposed on the subprocessor as on the processor; the processor is liable for its breaches of duty.
- Third country: If there is a third-country transfer (server location, support, subcontractors outside the EU/EEA), a transfer basis under Chapter V GDPR is required (adequacy decision or standard contractual clauses together with a Transfer Impact Assessment). If it is missing, the transfer is unlawful.
4. TOM comparison (Art. 32 GDPR)
Compare the technical and organizational measures described in the DPA (usually as an annex) with the requirements of Art. 32 GDPR: pseudonymization/encryption, confidentiality, integrity, availability and resilience, recoverability, regular review. Empty formulas ("appropriate measures") without a concrete description are not sufficient and must be noted as a defect.
5. Section 203 StGB review for professional secrecy holders
For professional secrecy holders (lawyers, tax advisors, doctors, notaries), GDPR compliance is not sufficient. Disclosing protected secrets to an external service provider affects Section 203 StGB. The service provider and its employees must be included as "contributing persons" under Section 203 (3), (4) of the German Criminal Code (StGB) and must be expressly obligated to maintain confidentiality; the scope of the secrets disclosed must be limited to what is necessary. If this obligation is absent, in addition to the data protection violation, there is a threat of criminal liability on the part of the professional secret holder.
6. Liability/Fine Risk
Violations of Art. 28 GDPR (missing or deficient DPA) are punishable under Art. 83 (4) GDPR with a fine of up to EUR 10 million or 2% of worldwide annual turnover (whichever amount is higher). In addition, possible damages claims by data subjects (Art. 82 GDPR) and – for professional secret holders – criminal liability under Section 203 StGB may arise.
7. Defect List
Finally, bundle all findings in a prioritized defect list : for each entry, the provision concerned, the specific defect and a proposed remedy. Separation into "blocking" (contract cannot be concluded) and "to be remedied".
Risks
- Incorrect role classification – DPA despite joint/own responsibility → wrong instrument, still unlawful.
- Sham clauses – lit. a–h merely copied verbatim, without operational substance → formally present, materially ineffective.
- Silent third-country transfer – support/subcontractors in a third country overlooked without a transfer basis.
- Section 203 StGB overlooked – for professional secret holders, criminal liability despite a formally clean GDPR DPA.
- Outdated TOM annex – technical and organizational measures do not correspond to the actual state.
Output format
AVV-PRÜFUNG — <Mandat/Vertrags-ID> — <Datum>
I. Rollenklärung Verantwortlicher: <…> | Auftragsverarbeiter: <…>
Echte Auftragsverarbeitung? [✅ / ⚠️ / ❌]
II. Pflichtklauseln (Art. 28 Abs. 3 lit. a–h)
a) Weisungsbindung [✅ / ❌ fehlende Pflichtklausel]
b) Vertraulichkeit [✅ / ❌]
c) Sicherheit (Art. 32) [✅ / ❌]
d) Unterauftragsverarb. [✅ / ❌]
e) Betroffenenrechte [✅ / ❌]
f) Unterstützung 32–36 [✅ / ❌]
g) Löschung/Rückgabe [✅ / ❌]
h) Nachweise/Audits [✅ / ❌]
III. Unterauftragsverarbeiter
Genehmigung (Abs. 2) [✅ / ❌]
Pflichtenweitergabe (Abs. 4) [✅ / ❌]
Drittland [kein / ⚠️ Transfergrundlage: <…>]
IV. TOM-Abgleich (Art. 32) [✅ / ⚠️ Leerformel / ❌]
V. § 203 StGB [n/a / ✅ Verpflichtung mitwirkender Personen / ❌]
VI. Bußgeld-/Haftungsrisiko Art. 83 Abs. 4 DSGVO: <Einordnung>
VII. Mängelliste
[blockierend] <Norm> — <Mangel> — <Nachbesserung>
[nachzubessern] <Norm> — <Mangel> — <Nachbesserung>
Empfehlung: <…>
Sources
Statute
- Art. 28 GDPR (processor)
- Art. 32 GDPR (security of processing)
- Art. 83 (4) GDPR (fines)
- Section 203 StGB (violation of private secrets)