Module 9 · 9.2

English

Nederlands English Deutsch Français Español Italiano

The data processing agreement and sub-processors

Module 9: People and rules · Reading time: 11 minutes

Learning objective: After this lesson you can read and check a data processing agreement against the points the GDPR requires, and assess a list of sub-processors.

Key concepts: data processing agreement (DPA), Art. 28(3) GDPR, written instructions, confidentiality, security measures, sub-processor, general or specific authorisation, right to object, assistance, returning or deleting, audit, transfer outside the EEA, data breach notification period, standard contractual clauses for processors

Why a data processing agreement?

In lesson 1.2 you saw the roles: Bakkerij De Korrel is the controller, the cloud service is the processor. Article 28(3) of the GDPR requires that processing by a processor be governed by a contract (or other legal act) that is set out in writing. Electronic form is fine too. That is the data processing agreement, abbreviated DPA, also called a Data Processing Addendum.

With large cloud services you don't sign a document yourself: the DPA is part of the terms you agree to, or you tick a box in the admin screen. With smaller providers you sometimes download a document, fill in your details and sign it. Either way, as controller you must be able to show that a DPA exists and what it says.

This is an explanation, not legal advice. If you have doubts about your own contracts, ask a lawyer or your data protection officer.

What the GDPR requires it to contain

Article 28(3) first lists the topics the agreement must describe: the subject matter and duration of the processing, the nature and purpose, the type of personal data, the categories of data subjects, and the rights and obligations of the controller. It then lists eight obligations of the processor (points a to h). Below in plain language, with the question you ask yourself when reading:

Art. 28(3)	What the processor must do	Your check question
a	Only process on your written instructions, including regarding transfers outside the EEA	Does it say the provider doesn't use the data for its own purposes?
b	Ensure staff are bound by confidentiality	Is there a confidentiality obligation for personnel?
c	Take appropriate security measures (Art. 32)	Are the measures listed, or is there a reference to an up-to-date document?
d	Only use sub-processors with your authorisation, and under the same obligations	Is there a list, and can you object?
e	Help with requests from data subjects (access, erasure)	Can the provider find and delete one person's data?
f	Help with security, data breaches and DPIAs (Art. 32 to 36)	How quickly does the provider report a data breach?
g	Return or delete all data after the service ends, at your choice	How long after cancelling can you retrieve your data, and when is it deleted?
h	Provide information and allow audits	Are there audit reports or certificates, and can you commission an audit?

The European Commission has also published standard contractual clauses for processors (Implementing Decision (EU) 2021/915). You may use these as a DPA; they cover all the required points. Many smaller providers use their own template, in the Netherlands often based on the model from industry associations.

Sub-processors: who is behind your provider?

Your cloud service doesn't do everything itself. A sub-processor is a party engaged by the processor that can access your data, for example:

the data centre (if it's not owned by the provider itself);
a backup storage supplier;
a company that filters mail for spam or viruses;
a support party or a developer with remote access;
an AI service, if the provider offers an AI feature.

Article 28(2) states: a processor shall not engage another processor without prior specific or general written authorisation of the controller. With general authorisation, the processor must inform you of new or replacement sub-processors, so that you can object. In practice it works like this: the provider publishes a list, announces changes (by email or on a page you can follow), and you have a period in which to object. If you object and no solution is found, you can usually cancel.

Under paragraph 4, the sub-processor must be bound by the same obligations, and the processor remains fully liable to you.

What to pay extra attention to when switching to a European provider

When switching to a European service, there are two things to look for in particular in the sub-processor list:

Where are the sub-processors located? A European provider that has a US service filter its mail, or stores its backups with a US cloud, still brings your data under the scope of the CLOUD Act (lesson 1.3). Check the country and parent company of each sub-processor.
What do they do? A domain registry that only knows your name and address as domain holder is quite different from a party that stores your mailboxes.

Also read the article about transfers. A good European DPA states that data is processed within the EU or EEA, and that transfers outside this area are only allowed with your prior authorisation. If it says "we may process data worldwide with appropriate safeguards", then you know transfers are possible.

Warning signs to watch for

No DPA available for a service used for business purposes: not a good choice.
An outdated list of sub-processors that doesn't match what the provider says elsewhere (for example, a different data centre): ask for clarification.
A data breach notification period so long that you can't meet your own 72-hour deadline (Art. 33). Many DPAs mention 24 or 48 hours.
Liability that is fully excluded. That's common to some extent, but it says something about how confident the provider is in itself.
No arrangement for the end of the service: what happens to your data after cancellation, and do you get confirmation of deletion?

Who signs, and where do you keep it?

At De Korrel, Sanne signs as owner. She keeps the DPA with the record of processing activities (lesson 9.3), along with the date and version. If the provider changes the DPA or the sub-processors, she also keeps that notification. If the data protection authority carries out a check, or a customer asks ("how do you handle my data?"), she can show it straight away.

In practice: what it looks like with a provider

WebOké has a standard data processing agreement with an appendix listing third parties engaged, stating that processing takes place within the EU and that transfers outside the EU are only allowed with written authorisation. The frequently asked questions in the Nextcloud manual explain when you need it. With other providers the document is often called a "Data Processing Agreement" and the sub-processor list is on a separate page ("Subprocessors"). Compare that list with what the provider says on its website about data centres and support.

Summary

Article 28(3) GDPR requires a written data processing agreement with fixed topics and eight obligations for the processor.
Check in particular: no own purposes, security, sub-processors, help with data breaches, returning or deleting data after the service ends, and audits.
Sub-processors only with your authorisation; with general authorisation you must be informed of changes and be able to object.
When switching to a European provider, check the country and parent company of each party in the sub-processor list.
Keep the DPA and change notifications together with your record of processing activities.

Quiz

Exercise

Exercise E9.2: Check a data processing agreement. Take the data processing agreement of your current or new cloud service. Go through the eight points a to h and note for each one: is it included (yes, no, unclear) and where. Assess the sub-processor list: note for each sub-processor the country, parent company and what it does.

Exercise E9.2: Check a data processing agreement

Take the data processing agreement from your current or new provider and go through the points from the lesson.

Which data processing agreement (provider, version or date)?

For each point a to h of Art. 28(3) GDPR: is it included (yes, no, unclear) and where (article number)?

Data breach notification period according to the agreement (in hours).

Sub-processors: name · what they do · country · parent company (and country) · outside the EEA (yes/no).

Period for retrieving data after cancellation, and when deletion takes place.

Which point would you want to discuss with the provider?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing