Data processing agreement

What is a data processing agreement?

A data processing agreement is a written agreement between you and a party that processes personal data on your behalf. That party is called the processor. You are the controller: you decide for what purpose and how the data is used.

The GDPR makes the agreement mandatory, in Article 28. If it is missing, you and the processor are both in breach.

What does a data processing agreement contain?

The processor may only use the data for your assignment, not for its own purposes. Among other things, the agreement sets out:

• which data it concerns, what it is used for and for how long;
• how the processor secures the data;
• that its employees are bound by confidentiality;
• whether it may engage other parties itself (sub-processors);
• how it helps you in the event of a data breach;
• what happens to the data when the assignment ends.

You remain responsible for the data, even if the processor drew up the agreement.

Example in an SME

When do you need a data processing agreement?

You need a data processing agreement when another party processes personal data for you. Think of software in the cloud, a hosting provider, a payroll administrator or someone who manages an integration for you.

Not every party is a processor. A party that decides for itself what it does with the data is itself responsible. The AP (Dutch Data Protection Authority) gives the example of a logistics service provider that delivers parcels. What counts is what happens in practice, not what is on paper.

For each assignment, you and I sign a data processing agreement. You can also read that in how I work.

Frequently asked questions

This is an explanation in plain language, not legal advice.

Source: Dutch Data Protection Authority (Autoriteit Persoonsgegevens): Data processing agreement (in Dutch), consulted on 7 October 2026.