Requirements for a data processing agreement: a guide for businesses

In a digitalised world where we rely on cloud services, IT suppliers and external specialists, compliance is essential. A data processing agreement (DPA) is not just a piece of paper; it is the legal framework that ensures personal data is processed correctly and securely in accordance with GDPR.

What is a data processing agreement?

A data processing agreement is a binding contract between the data controller (your business) and a data processor (your supplier). The agreement dictates how the data processor may handle the personal data they are given access to, and ensures that they meet the strict requirements for IT security and privacy protection.

The 5 legal requirements for the content

GDPR Article 28 sets specific requirements for what a data processing agreement must contain. Here are the 5 most important elements:

Purpose and duration: The agreement must precisely define why data is processed and for how long the processing will take place. This is about data minimisation – data may only be retained for as long as necessary.
Data types and categories: It must be clear which types of personal data are involved. Is it ordinary data such as names and email addresses, or sensitive data that requires extra protection?
Instructions from the data controller: The data processor may only process data on the basis of documented instructions from you. This ensures that your supplier does not take liberties with your data.
Security measures: The technical and organisational security measures that have been put in place must be documented. This can be anything from encryption and access control to the physical security of server rooms.
Sub-processors: If your supplier uses subcontractors (e.g. a cloud provider), this must be approved. The rules must ensure that the same high level of protection follows all the way down the supply chain.

When do you need an agreement?

You must enter into a data processing agreement every time an external party handles personal data on behalf of your business. This applies to everything from your IT operations provider and cloud solutions to payroll systems and CRM platforms.

Need help with IT compliance?

Are you unsure whether your current agreements are adequate, or do you need advice on security in your data handling? At Teknisk Support we help SMEs in Kolding and the Triangle Region navigate the rules.

FAQ about data processing agreements

Below you will find answers to the most frequently asked questions about data processing agreements:

Who is responsible for drawing up the data processing agreement?

It is the responsibility of the data controller to ensure that a data processing agreement is in place with all of its data processors.

Do I need a data processing agreement with my cloud provider?

Yes, if your cloud provider processes personal data on behalf of your business, a data processing agreement is a legal requirement under GDPR.

What happens if I do not have a data processing agreement?

The absence of a data processing agreement is a breach of GDPR and can result in fines from the Danish Data Protection Agency (Datatilsynet) as well as an order to stop the data processing.

Does a data processing agreement need to be renewed regularly?

The agreement should be reviewed regularly, especially if there are changes in processing activities, sub-processors or technical security requirements.

Is a standard template enough for my business?

A template is a good starting point, but it must always be adapted to your business's specific data processing and IT environment to ensure full compliance.