Data Processing Agreement Drafting

Overview

GDPR Article 28(3) mandates that processing by a processor shall be governed by a contract or other legal act that is binding on the processor. This contract must set out specific mandatory provisions covering the subject-matter and duration of processing, the nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. The EDPB has emphasized in Guidelines 07/2020 that these requirements are not optional and that failure to include any mandatory element renders the DPA non-compliant.

The European Commission adopted Standard Contractual Clauses for controller-to-processor arrangements in Implementing Decision (EU) 2021/915, providing a reference framework that organizations may adopt or adapt.

Mandatory DPA Provisions Under Article 28(3)

Provision 1: Subject-Matter and Duration

The DPA must specify what processing the vendor will perform and for how long.

Required Elements: