Startups, SaaS companies, and businesses subject to GDPR using third-party tools like payroll platforms, CRM, email marketing, HR software, or cloud hosting that handle personal data.
They'll gain clarity on identifying processors vs controllers, ensuring compliant DPAs, reviewing sub-processors and transfers, and simple steps to map and fix gaps for full compliance.
What Is a Data Processing Agreement (DPA)? A data processing agreement is a contract between you and a supplier that sets out how they are permitted to handle personal data you share with them.
What's the Difference Between a Controller and a Processor? This distinction is the foundation of how GDPR allocates responsibility. You are the controller if you decide why personal data is collected and what it's used for.
When Is a DPA Legally Required? A DPA is required under Article 28 of the GDPR any time a controller uses a processor. In practice, that means almost every third-party tool a startup uses.
Payroll platforms — processing employee names, salaries, bank details, tax informationCRM software — storing customer and prospect contact dataEmail marketing platforms — holding subscriber lists and engagement dataCloud hosting providers — storing any personal data that lives in your infrastructureHR software — employee records, performance data, leave managementCustomer support tools — tickets containing customer personal informationAccounting software — client and supplier financial dataVideo conferencing tools — names, email addresses, meeting recordingsIf a supplier touches personal data and processes it on your behalf, a DPA is required. There is no minimum threshold of data volume that triggers the requirement.
What Must a DPA Contain? The subject matter and duration of the processingThe nature and purpose of the processingThe type of personal data involved and the categories of data subjectsThe obligations and rights of the controllerBeyond that framing, the DPA must require the processor to:
Only process data on documented instructions from the controller Ensure that anyone with access to the data is bound by confidentiality obligations Implement appropriate technical and organisational security measures Not engage sub-processors without the controller's prior consent Assist the controller in responding to data subject requests (access, erasure, correction)Assist with breach notifications and security obligationsDelete or return all personal data at the end of the contractProvide the controller with all information necessary to demonstrate compliance , including allowing audits If any of these elements are missing, the agreement does not satisfy the Article 28 requirement, even if both parties signed it.
How to Handle Suppliers Who Provide Their Own Standard DPA Most large suppliers - Google, Salesforce, Mailchimp, HubSpot, AWS - have standard DPAs that you agree to as part of their terms of service, often by ticking a box or accepting updated terms. This is common and generally acceptable, but there are things worth checking which are outlined below.
Does their DPA actually cover Article 28? Large, well-resourced suppliers usually have compliant DPAs drafted by experienced privacy counsel. Smaller or newer suppliers may not. Check that the mandatory elements are all present.
Who are their sub-processors? Most suppliers use sub-processors, third parties they in turn share your data with. A compliant DPA will list these or link to a regularly updated register. Review it. If a sub-processor is in a country outside the UK or EEA, additional transfer safeguards are required.
What happens to your data when you leave? The DPA should specify that data is returned or deleted at the end of the relationship, on your request, within a defined timeframe. In our experience, vague commitments here are worth pushing back on and requesting additional information.
Can you actually audit them? Article 28 requires processors to allow audits. In practice, large suppliers offer audit reports (SOC 2, ISO 27001) rather than letting customers conduct their own. This is generally accepted, but the right should be reflected in the DPA.Data Protection Commission ever asks, you need to be able to produce it quickly.
What About Data Transfers Outside the EEA? If your processor is based outside the European Economic Area, or uses sub-processors that are, additional safeguards are required under Chapter V of the GDPR.GDPR violation on top of any DPA shortcoming.
What Happens If You Don't Have a DPA? The absence of a DPA is itself a breach of Article 28, even if the underlying data is being handled appropriately.due diligence if you raise investment or go through an acquisition process. Investors and acquirers expect to see a
A Simple Starting Point List every supplier that receives personal data from your business Identify whether they are a processor (acting on your instructions) or a controller in their own right Check whether a DPA is already in place, often buried in their terms of service For any gaps, request a DPA or accept theirs if it covers the Article 28 requirements Keep a central record of where each DPA is held
