Overview
GDPR Article 28(3) mandates that processing by a processor shall be governed by a contract or other legal act that is binding on the processor. This contract must set out specific mandatory provisions covering the subject-matter and duration of processing, the nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. The EDPB has emphasized in Guidelines 07/2020 that these requirements are not optional and that failure to include any mandatory element renders the DPA non-compliant.
The European Commission adopted Standard Contractual Clauses for controller-to-processor arrangements in Implementing Decision (EU) 2021/915, providing a reference framework that organizations may adopt or adapt.
Mandatory DPA Provisions Under Article 28(3)
Provision 1: Subject-Matter and Duration
The DPA must specify what processing the vendor will perform and for how long.
Required Elements:
| Element | Description | Example |
|---|---|---|
| Subject-matter | The specific service being provided | "Cloud-hosted customer analytics platform" |
| Duration | Period of processing | "Duration of the Master Services Agreement plus 90-day data return/deletion period" |
| Commencement date | When processing begins | "Effective as of the MSA effective date" |
| Survival clauses | Obligations surviving termination | "Confidentiality, deletion certification, and audit rights survive for 3 years" |
Provision 2: Nature and Purpose of Processing
Required Elements:
| Element | Description | Example |
|---|---|---|
| Nature of processing | Operations performed on personal data | "Collection via API ingestion, storage in encrypted database, automated analysis, aggregated reporting, deletion upon contract termination" |
| Purpose of processing | Why processing occurs | "To provide Summit Cloud Partners with customer behavior analytics enabling product improvement decisions" |
| Processing instructions scope | Boundaries of processing | "Processor shall process personal data only for the purposes specified in Annex 1 and only on documented instructions from the Controller" |
Provision 3: Type of Personal Data
Enumerate all categories of personal data the processor will handle.
Summit Cloud Partners — Example Annex:
| Data Category | Description | Sensitivity Level |
|---|---|---|
| Contact information | Name, email address, phone number | Standard |
| Account identifiers | User ID, account number, tenant ID | Standard |
| Usage data | Feature usage logs, session duration, click paths | Standard |
| Device information | IP address, browser type, OS version | Standard |
| Location data | City/region derived from IP address (not precise GPS) | Elevated |
| Payment metadata | Transaction dates, plan type (not card numbers) | Elevated |
Provision 4: Categories of Data Subjects
| Category | Description | Approximate Volume |
|---|---|---|
| Enterprise customers | Named users of Summit Cloud Partners platform | 50,000 |
| Trial users | Users on free trial accounts | 15,000 |
| API consumers | Developers using Summit Cloud Partners API | 5,000 |
Provision 5: Obligations and Rights of the Controller
The DPA must set out what the controller is entitled to do and what the controller must provide to the processor:
- Right to issue instructions: The controller has the right to issue documented written instructions regarding processing
- Right to audit: The controller may audit the processor's compliance (Article 28(3)(h))
- Obligation to determine lawful basis: The controller confirms that processing is lawful under Article 6
- Obligation to respond to data subjects: The controller is responsible for responding to data subject requests, with processor assistance
- Obligation to notify processor of relevant changes: Changes to processing instructions, data categories, or regulatory requirements
Provision 6: Processor Obligations (Article 28(3)(a)-(h))
The eight mandatory processor obligations under Article 28(3):
(a) Process only on documented instructions
"The Processor shall process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest."
(b) Confidentiality obligations
"The Processor shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality."
(c) Security measures (Article 32)
"The Processor shall implement all measures required pursuant to Article 32, including as appropriate: (i) pseudonymisation and encryption of personal data; (ii) the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems; (iii) the ability to restore availability and access to personal data in a timely manner in the event of a physical or technical incident; (iv) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures."
(d) Sub-processor conditions
"The Processor shall not engage another processor without prior specific or general written authorisation of the Controller. In the case of general written authorisation, the Processor shall inform the Controller of any intended changes concerning the addition or replacement of other processors, thereby giving the Controller the opportunity to object to such changes."
(e) Assist with data subject rights
"Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III."
(f) Assist with compliance obligations
"The Processor shall assist the Controller in ensuring compliance with Articles 32 to 36, taking into account the nature of processing and the information available to the Processor."
(g) Deletion or return after termination
"At the choice of the Controller, the Processor shall delete or return all personal data to the Controller after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the personal data."
(h) Audit rights
"The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28, and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller."
Provision 7: Sub-Processor Cascade
When the processor engages sub-processors, Article 28(4) requires the same data protection obligations as in the controller-processor DPA to be imposed on the sub-processor by way of a contract. The sub-processor DPA must contain materially equivalent terms.
Sub-processor management provisions:
| Provision | Description |
|---|---|
| Authorization mechanism | General written authorization with notification of changes |
| Notification period | Minimum 30 calendar days before engaging new sub-processor |
| Objection right | Controller may object within the notification period |
| Objection consequence | If objection not resolved, either party may terminate affected services |
| Flow-down obligations | Sub-processor contract must impose equivalent Article 28(3) obligations |
| Liability | Processor remains fully liable for sub-processor compliance |
Provision 8: International Transfers
If personal data will be transferred outside the EEA, the DPA must address the transfer mechanism:
| Transfer Scenario | Required Mechanism |
|---|---|
| EEA to Adequacy country (per Art. 45) | Reference adequacy decision |
| EEA to non-adequate country | Standard Contractual Clauses (Commission Decision 2021/914) |
| EEA to non-adequate country with supplementary measures | SCCs plus technical/organizational/contractual supplementary measures per EDPB Recommendations 01/2020 |
DPA Drafting Checklist
| # | Requirement | Article | Status |
|---|---|---|---|
| 1 | Subject-matter and duration specified | 28(3) | [ ] |
| 2 | Nature and purpose of processing defined | 28(3) | [ ] |
| 3 | Types of personal data listed | 28(3) | [ ] |
| 4 | Categories of data subjects listed | 28(3) | [ ] |
| 5 | Controller obligations and rights defined | 28(3) | [ ] |
| 6 | Processor processes only on documented instructions | 28(3)(a) | [ ] |
| 7 | Confidentiality obligations for authorized personnel | 28(3)(b) | [ ] |
| 8 | Article 32 security measures implemented | 28(3)(c) | [ ] |
| 9 | Sub-processor conditions and authorization | 28(3)(d) | [ ] |
| 10 | Assistance with data subject rights | 28(3)(e) | [ ] |
| 11 | Assistance with Articles 32-36 compliance | 28(3)(f) | [ ] |
| 12 | Deletion or return upon termination | 28(3)(g) | [ ] |
| 13 | Audit rights and information access | 28(3)(h) | [ ] |
| 14 | Sub-processor flow-down obligations per Art. 28(4) | 28(4) | [ ] |
| 15 | International transfer mechanism (if applicable) | 28(3), Ch. V | [ ] |
| 16 | Breach notification obligations per Art. 33(2) | 33(2) | [ ] |
| 17 | DPA is in writing (including electronic form) | 28(9) | [ ] |
Key Regulatory References
- GDPR Article 28(3) — Mandatory DPA provisions
- GDPR Article 28(4) — Sub-processor flow-down obligations
- GDPR Article 28(9) — Written form requirement
- GDPR Article 32 — Security of processing
- GDPR Article 33(2) — Processor breach notification to controller
- Commission Implementing Decision (EU) 2021/915 — Standard Contractual Clauses for controller-to-processor
- EDPB Guidelines 07/2020 — Controller and processor concepts
- EDPB Recommendations 01/2020 — Supplementary measures for international transfers