Data processing agreement (DPA): when you need one
When a small business needs a DPA, controller or processor, what GDPR Article 28 asks for, Korea’s entrustment rule, and a breach timeline example.
The short answer
You need a data processing agreement (DPA) when another business handles personal data on your behalf: hosting your customer database, sending your newsletters, running your payroll, or a freelancer working inside your systems. You decide why and how the data is used, so you are the controller; they act on your instructions, so they are the processor.
In the EU and the UK, the GDPR requires that relationship to be governed by a contract with specific content (Article 28). Korea’s Personal Information Protection Act asks for a written entrustment too (Article 26). Other countries have their own rules, so check the law that applies to you.
Controller or processor: a quick test
Ask who decides the purpose. A few common cases:
- A hosting or software-as-a-service provider storing your customer records: processor.
- An email service sending your newsletter to your list: processor.
- A freelance developer with access to your production database: processor.
- An accountant or lawyer using client data under their own professional duties: often a controller in their own right.
- Two businesses that jointly decide why and how data is used may be joint controllers, which needs a different arrangement.
What Article 28 asks the contract to contain
The GDPR lists the content of the contract between controller and processor. It sets out the subject matter and duration of the processing, its nature and purpose, the types of personal data and the categories of people concerned, and the controller’s rights and obligations. The processor must:
- Process the data only on the controller’s documented instructions, including on transfers to other countries.
- Make sure the people who handle it are bound to confidentiality.
- Take appropriate security measures.
- Use sub-processors only with the controller’s authorisation and the same duties passed on.
- Help the controller answer people who exercise their rights, and with security, breach and risk duties.
- Delete or return the data at the end, and give the controller the information needed to check all this, including audits.
Worked example: an online shop and its newsletter service
An online shop uses a newsletter service. The DPA states the subject as sending newsletters to customers who signed up, the data as names, email addresses and order history, and the people as customers. The service lists its email delivery provider as a sub-processor and must give 30 days’ notice before adding another, as the sample sets.
The service discovers a breach on 2026-10-06 at 09:00. The sample gives it 48 hours to tell the shop, so by 2026-10-08 at 09:00; it tells the shop on 2026-10-07 at 15:00. Under GDPR Article 33 the shop, as controller, notifies the supervisory authority where feasible within 72 hours of becoming aware, so by 2026-10-10 at 15:00, unless the breach is unlikely to result in a risk to people. A clear notice deadline in the DPA is what makes the controller’s own deadline reachable.
Korea: entrustment in writing
Under Article 26 of Korea’s Personal Information Protection Act, a business that entrusts the processing of personal information to another must do so in writing, covering at least a ban on processing outside the entrusted work and the technical and managerial safeguards, with further items set by decree. It must make the entrusted work and the processor easy for the people concerned to find, usually in its privacy policy, and a processor may sub-entrust only with the entrusting business’s consent.
Using the QuoteBill sample
QuoteBill’s data processing agreement sample is added to an existing service contract and prevails on personal data. It has blanks for the processing, the security measures, the sub-processors and their locations, the breach notice period, the countries where data is stored, and the data protection law that applies; it says each party must check what that law requires and add any missing terms. Read it in full on its public page before signing in.
Send it through E-Contracts with the service contract. It is a simple electronic signature with an audit trail, not an advanced or qualified electronic signature, and QuoteBill does not verify who signs; whether that is enough depends on the contract and the country. The sample is not legal advice.
Check before you sign a DPA
For both sides, controller and processor:
- The purpose, the data types and the people concerned are described, not left generic.
- Sub-processors are named with their locations, and changes need notice.
- The breach notice period leaves the controller time to meet its own deadline.
- Transfers to other countries are listed with the safeguards the law requires.
- Return or deletion at the end has a deadline and a written confirmation.
- The law that applies is named, and nothing in the DPA gives less protection than it requires.
Questions people ask
Do I need a DPA with my email or hosting provider? If they process personal data for you and the GDPR or a similar law applies, yes. Large providers usually publish one you accept with their terms; read it and keep a copy.
Is a confidentiality clause in my service contract enough? Not under the GDPR. Article 28 asks for specific content, such as documented instructions, sub-processor rules and help with people’s rights, that a confidentiality clause does not cover.
Does a freelancer who sees my customer data need to sign one? If they process that data on your behalf, a DPA or equivalent terms are the safe course. Limit their access to what the work needs.
Who notifies the authority after a breach? The controller decides and notifies; the processor must tell the controller quickly and help. Under the GDPR the controller’s deadline is 72 hours where feasible.
Sources
Browse the 119 sample contracts
250 Free Invoice, Quote & Receipt Templates
Software maintenance invoice
Invoice template for developers on a support contract: monthly bug fixes, security patch deployment and incident response. Download it as Excel or Word.
IT support invoice
Invoice template for IT support providers: office PC setup, account access recovery and remote technical support. Fill it in online or download Excel or Word.
Web development invoice
Invoice template for web developers: feature implementation, responsive build, and deployment and checks. Fill it in online or download Excel or Word.
Use QuoteBill in ChatGPT, Claude and Gemini
Connect QuoteBill to ChatGPT, Claude or Gemini in about three minutes, then ask for quotations and invoices in plain words. Setup steps, example requests and privacy.
Quote to invoice: convert an accepted quote
Turn an accepted quote into a separate invoice draft in QuoteBill. Keep the original quotation, review dates and amounts, save, and prepare a PDF.
Quotation vs invoice: differences and timing
Compare a quotation and an invoice by purpose, dates, amounts, and next steps. Follow a practical project example and the matching QuoteBill workflow.
How to write a quotation: fields and checklist
Write a clear quotation with customer details, scope, quantities, prices, dates, and terms. Use a worked example and check the QuoteBill PDF before sharing.
Invoice payment terms: Net 15, Net 30, due dates
Write clear invoice payment terms with Net 15 and Net 30 examples, an explicit due date, deposit checks, and a practical follow-up checklist.
Freelance invoice checklist: hours and fees
Prepare a freelance invoice with a worked hourly-plus-fixed-fee example, scope and expense checks, billing details, and a PDF checklist before sending.
International invoice currency: rates and fees
Clarify invoice currency, settlement currency, exchange-rate examples, and bank fees. Review cross-border tax and QuoteBill country-setting limits.
Invoice numbering: sequences and corrections
Plan a traceable invoice numbering system with year and sequence examples, checks across devices, correction records, and QuoteBill numbering limits.
Proforma vs invoice: payment and export use
Compare a proforma, payment invoice, and commercial export invoice with a worked goods-order example and a checklist for choosing the right document.
German invoice requirements: the mandatory details
What a German invoice must contain under § 14 UStG, the small-amount invoice up to EUR 250, small-business and reverse-charge notes, and the e-invoice dates.
Japan qualified invoice: the required entries
The six entries a Japanese qualified invoice must carry, how the registration number is written, how amounts are split by tax rate and rounded, and when a simplified invoice is allowed.
Korean tax invoice: required entries and the electronic form
The four mandatory entries on a Korean tax invoice, the optional ones, when an electronic tax invoice must be issued and transmitted, and how it differs from an exempt-supply invoice.
Quote, proforma, invoice, receipt, credit note: which to use
Which document belongs to which stage of a sale: when each is issued, who issues it, what it shows and its tax effect, with one order traced end to end.
Credit note vs invoice (and credit memo): how to issue one
When to issue a credit note instead of editing an invoice, what it must show, a worked return example, and how it differs from a credit memo and a debit note.
What a receipt must show (and receipt vs invoice)
What to put on a payment receipt, how it differs from an invoice, how to handle deposits and part payments, and a worked example: two receipts, one invoice.
Estimate vs quote: what binds you, with a remodeling example
Estimate or quote: the practical difference, splitting labor, materials and equipment, clauses for hidden damage and changes, and a worked remodeling example.
Are QuoteBill e-signatures legally binding? How they work
What a QuoteBill e-signature records, how EU, US, Korean, Japanese and German law treat simple electronic signatures, and which documents need another form.
Simple, advanced or qualified e-signature?
The three eIDAS levels in plain words, where QuoteBill's simple signature fits, when it is enough, and how Korea, Japan and Germany draw the line.
Japan’s stamp duty: do electronic contracts need a stamp?
Why an electronic contract needs no Japanese revenue stamp, when a printout or paper original becomes taxable, and which paper contracts still need one.
Japan: keeping an electronic contract as a tax record
Keeping a contract made by email or e-signing service as data under Japan's electronic transaction rules: retention period, requirements, 2024 grace measure.
Japan's Freelance Act: terms a client must put in writing
What a Japanese client must state when commissioning a freelancer: the eight items, email and chat as valid means, the 60-day payment rule and where to turn.
Free DocuSign alternative for simple contracts
A free way to get a simple contract signed online: what QuoteBill E-Contracts does, what it does not, and when you need an advanced e-signature service.
Free invoice template in Excel, Word or PDF
Which format suits an invoice: Excel with live formulas, editable Word or PDF. Fill it in online, no download needed, with a worked example and a checklist.
Free quotation template in Excel, Word or PDF
Excel, Word or PDF for a quotation: live formulas while the price moves, editable wording, a final PDF. With a painting example and a pre-send checklist.
119 English contract templates to edit and save as PDF
119 sample contracts with English clauses: read each in full, edit online, save as PDF. Why there is no Word file, and what to check before use.
Compare free invoice generators: ten checks
Ten product-neutral checks for a free invoice generator: formats, account, tax, numbering, data and price. Where QuoteBill meets each, and where it does not.
How to write an invoice: a step-by-step example
The ten parts of an invoice in order, a worked example with tax and a deposit, what changes in the US, UK, EU, Australia, Japan and Korea, and a final check.
UK VAT invoice requirements: full, simplified, modified
What HMRC says a full UK VAT invoice must show, when a simplified or modified invoice is enough, when no VAT invoice is needed, with a worked 20% example.
EU VAT invoice requirements and the reverse charge
The Article 226 list of what an EU invoice must show, the reverse charge on cross-border sales, the 15th-day deadline and the e-invoicing change of 2030.
Australian tax invoice: GST requirements explained
What an Australian tax invoice must show under and over $1,000, the $82.50 and 28-day rules, and what to send if you are not registered for GST.
How to calculate VAT: add it, remove it, round it
The three VAT formulas, taking tax out of a gross price without the usual mistakes, rounding per line or on the subtotal, and showing VAT on an invoice.
Korea’s 3.3% freelancer withholding: how to invoice
Why Korean clients deduct 3.3% from freelance fees, who it applies to, a worked 1,500,000-won example, how to write the invoice and what happens at year end.
Deposit invoice: bill upfront, then invoice the balance
How to agree, invoice and receipt a deposit, two ways to bill the balance, when tax falls due on a deposit, and a worked 30% example that adds up.
Payment reminder email: three templates and timing
A polite reminder schedule, three emails to adapt for an overdue invoice, how to handle part payments, and when interest or fees may be added.
How to price freelance work: hourly, day rate or project
Work out an hourly rate from your income target, costs and billable hours, turn it into a day rate and a project price, and choose the right pricing model.
Retainer vs hourly billing: which to use and how to bill
How a monthly retainer and hourly billing share the risk, one quarter billed both ways, what a retainer agreement should say, and how to invoice each.
Freelance contract checklist: 12 points before signing
Twelve points every freelance contract should settle, a website job filled in clause by clause, the client’s side of it, and how to sign it online.
How to write a statement of work (SOW), with an example
What a statement of work contains, how to write a scope that can be checked, a three-milestone example, acceptance and changes, and billing each milestone.
When do you need an NDA? Mutual vs one-way
When a non-disclosure agreement helps and when it does not, mutual or one-way, the clauses that matter, and a worked example of an agency pitch.
How to get a contract signed online, step by step
From draft to signed copy: sending the link and code, what to tell your client, reminders, deadlines, lost links and corrections, and what to keep afterwards.
Influencer sponsorship contract: what to agree first
What creators and brands should agree before a paid post: deliverables, approval, ad disclosure, usage rights, exclusivity and fees, with a worked example.
Video editor contract: revisions, files and rights
What a creator and a video editor should agree: included tasks, revision rounds, ownership, AI tools, account access, music licences and a monthly fee example.
Licensing AI-generated artwork: what to put in writing
What copyright offices say about images made with AI tools, what an honest licence should state, likenesses and tool terms, and a book cover example.
SLA for a small SaaS: uptime, credits and support
What an SLA covers, what 99.9% or 99.5% uptime means in minutes, how service credits work with a worked example, and support hours and exclusions.
Data processing agreement (DPA): when you need one
When a small business needs a DPA, controller or processor, what GDPR Article 28 asks for, Korea’s entrustment rule, and a breach timeline example.
Create invoices from a spreadsheet automatically
Three ways to turn spreadsheet rows into invoices, how to plan the sheet, a three-row example, how the API automation runs and the limits to plan around.
Unpaid invoice: follow-ups, part payments and statements
What a customer still owes after part payments and credit notes, how to follow up before and after the due date, and when to send a statement of account.