Data processing agreement (DPA): when you need one

When a small business needs a DPA, controller or processor, what GDPR Article 28 asks for, Korea’s entrustment rule, and a breach timeline example.

The short answer

You need a data processing agreement (DPA) when another business handles personal data on your behalf: hosting your customer database, sending your newsletters, running your payroll, or a freelancer working inside your systems. You decide why and how the data is used, so you are the controller; they act on your instructions, so they are the processor.

In the EU and the UK, the GDPR requires that relationship to be governed by a contract with specific content (Article 28). Korea’s Personal Information Protection Act asks for a written entrustment too (Article 26). Other countries have their own rules, so check the law that applies to you.

Controller or processor: a quick test

Ask who decides the purpose. A few common cases:

  • A hosting or software-as-a-service provider storing your customer records: processor.
  • An email service sending your newsletter to your list: processor.
  • A freelance developer with access to your production database: processor.
  • An accountant or lawyer using client data under their own professional duties: often a controller in their own right.
  • Two businesses that jointly decide why and how data is used may be joint controllers, which needs a different arrangement.

What Article 28 asks the contract to contain

The GDPR lists the content of the contract between controller and processor. It sets out the subject matter and duration of the processing, its nature and purpose, the types of personal data and the categories of people concerned, and the controller’s rights and obligations. The processor must:

  • Process the data only on the controller’s documented instructions, including on transfers to other countries.
  • Make sure the people who handle it are bound to confidentiality.
  • Take appropriate security measures.
  • Use sub-processors only with the controller’s authorisation and the same duties passed on.
  • Help the controller answer people who exercise their rights, and with security, breach and risk duties.
  • Delete or return the data at the end, and give the controller the information needed to check all this, including audits.

Worked example: an online shop and its newsletter service

An online shop uses a newsletter service. The DPA states the subject as sending newsletters to customers who signed up, the data as names, email addresses and order history, and the people as customers. The service lists its email delivery provider as a sub-processor and must give 30 days’ notice before adding another, as the sample sets.

The service discovers a breach on 2026-10-06 at 09:00. The sample gives it 48 hours to tell the shop, so by 2026-10-08 at 09:00; it tells the shop on 2026-10-07 at 15:00. Under GDPR Article 33 the shop, as controller, notifies the supervisory authority where feasible within 72 hours of becoming aware, so by 2026-10-10 at 15:00, unless the breach is unlikely to result in a risk to people. A clear notice deadline in the DPA is what makes the controller’s own deadline reachable.

Korea: entrustment in writing

Under Article 26 of Korea’s Personal Information Protection Act, a business that entrusts the processing of personal information to another must do so in writing, covering at least a ban on processing outside the entrusted work and the technical and managerial safeguards, with further items set by decree. It must make the entrusted work and the processor easy for the people concerned to find, usually in its privacy policy, and a processor may sub-entrust only with the entrusting business’s consent.

Using the QuoteBill sample

QuoteBill’s data processing agreement sample is added to an existing service contract and prevails on personal data. It has blanks for the processing, the security measures, the sub-processors and their locations, the breach notice period, the countries where data is stored, and the data protection law that applies; it says each party must check what that law requires and add any missing terms. Read it in full on its public page before signing in.

Send it through E-Contracts with the service contract. It is a simple electronic signature with an audit trail, not an advanced or qualified electronic signature, and QuoteBill does not verify who signs; whether that is enough depends on the contract and the country. The sample is not legal advice.

Check before you sign a DPA

For both sides, controller and processor:

  • The purpose, the data types and the people concerned are described, not left generic.
  • Sub-processors are named with their locations, and changes need notice.
  • The breach notice period leaves the controller time to meet its own deadline.
  • Transfers to other countries are listed with the safeguards the law requires.
  • Return or deletion at the end has a deadline and a written confirmation.
  • The law that applies is named, and nothing in the DPA gives less protection than it requires.

Questions people ask

Do I need a DPA with my email or hosting provider? If they process personal data for you and the GDPR or a similar law applies, yes. Large providers usually publish one you accept with their terms; read it and keep a copy.

Is a confidentiality clause in my service contract enough? Not under the GDPR. Article 28 asks for specific content, such as documented instructions, sub-processor rules and help with people’s rights, that a confidentiality clause does not cover.

Does a freelancer who sees my customer data need to sign one? If they process that data on your behalf, a DPA or equivalent terms are the safe course. Limit their access to what the work needs.

Who notifies the authority after a breach? The controller decides and notifies; the processor must tell the controller quickly and help. Under the GDPR the controller’s deadline is 72 hours where feasible.

Sources

Browse the 119 sample contracts

250 Free Invoice, Quote & Receipt Templates

  • Software maintenance invoice

    Invoice template for developers on a support contract: monthly bug fixes, security patch deployment and incident response. Download it as Excel or Word.

  • IT support invoice

    Invoice template for IT support providers: office PC setup, account access recovery and remote technical support. Fill it in online or download Excel or Word.

  • Web development invoice

    Invoice template for web developers: feature implementation, responsive build, and deployment and checks. Fill it in online or download Excel or Word.