{"id":6162,"date":"2026-11-06T22:59:00","date_gmt":"2026-11-06T21:59:00","guid":{"rendered":"https:\/\/www.lablogic.pl\/?p=6162"},"modified":"2026-11-07T00:40:36","modified_gmt":"2026-11-06T23:40:36","slug":"data-processing-agreement","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/data-processing-agreement\/","title":{"rendered":"What must a personal data processing agreement contain?"},"content":{"rendered":"\n

Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for DPOs, compliance and procurement \u2022 published November 6, 2026 \u2022 15 min read<\/p>\n\n\n\n

\n
\n
\n\n\n\n<\/div>\n<\/div>\n\n\n\n
\n
\n

Short answer<\/h2>\n\n\n\n

A data processing agreement is needed when a service provider processes personal data on behalf of the organisation, that is, acts as a processor (Article 4(8) GDPR). Instead of a contract, it may be another legal act under Union or Member State law that is binding on the processor with regard to the controller (Article 28(3)). The controller may use only processors providing sufficient guarantees to implement appropriate technical and organisational measures (Article 28(1)).<\/p>\n\n\n\n

The agreement sets out the subject-matter and duration of the processing and its nature and purpose. It specifies the type of personal data and the categories of data subjects, as well as the obligations and rights of the controller. It binds the processor to at least eight obligations in Article 28(3)(a)\u2013(h). They concern documented instructions, confidentiality of authorised persons and security measures. The next ones cover other processors and assistance with data subject requests and with the obligations in Articles 32\u201336. The last ones cover deletion or return of the data after the end of the services, as well as information and audits. The exceptions cover processing and storage of data required by Union or Member State law to which the provider is subject. An appropriate statutory obligation of confidentiality may apply instead of a commitment to confidentiality. The provider also immediately informs the controller of an instruction which, in the provider’s opinion, infringes data protection provisions.<\/p>\n\n\n\n

Another processor (a sub-processor) requires the controller’s prior specific or general written authorisation (Article 28(2)). The initial processor imposes on it the same data protection obligations by way of a contract or other legal act and remains fully liable to the controller for their performance (Article 28(4)). The agreement is in writing, including in electronic form (Article 28(9)), and the meaning of this requirement under Polish law is disputed. It may be based on standard contractual clauses adopted by the European Commission (Article 28(6) and (7)).<\/p>\n<\/div>\n\n\n\n

When a service provider is a processor<\/h2>\n\n\n\n

According to Guidelines 07\/2020 of the European Data Protection Board (EDPB), two conditions determine the role. The provider is a separate entity from the controller and processes personal data on its behalf (paragraph 76). A company in the same group can be a processor, but a department of the same company cannot (paragraph 77). Where a service bought by one group company covers the data of other companies, the agreement may bind the provider directly towards each of them (Article 28(3)). Another arrangement is for one company to sign as the processor of the other companies, with data processing agreements and their authorisation of the provider as a sub-processor (Article 28(2)\u2013(4)).<\/p>\n\n\n\n

According to the EDPB, the role is decided by what the provider actually does with the data, not by the name of the contract (paragraph 82, footnote 42). The EDPB recalls that not every service provider that processes personal data in the course of delivering a service is a processor (paragraph 82). A provider that itself determines the purposes and means of the processing needed for the service is a separate controller. The same provider may be a controller for some operations and a processor for others (paragraph 82). According to the EDPB, a provider that uses the entrusted data to develop its own business without the client’s instruction infringes the GDPR and becomes the controller of that processing (paragraph 81). In the EDPB examples, an IT support company with inevitable and systematic access to data is a processor, provided that the client determines the purposes and means of the processing (paragraph 83).<\/p>\n\n\n\n

According to the Polish Personal Data Protection Office (UODO), a data processing agreement is necessary where the controller uses an external entity to achieve its own purposes related to the processing of data. These are ancillary, often technical services in which the provider follows the controller’s instructions at least as to the purpose and the essential elements of the means of processing. The examples given by UODO include storing data in the provider’s infrastructure, keeping accounting and HR records and destroying information carriers.<\/p>\n\n\n\n

Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers (Article 26(1)). Instead of a data processing agreement, they then determine their respective responsibilities by means of an arrangement between them unless and in so far as Union or Member State law determines those responsibilities. According to UODO, a service contract covering the tasks of the data protection officer under Article 39(1) is not a data processing agreement. According to the EDPB, the absence of an agreement where processing is in fact entrusted infringes Article 28(3) where no other relevant legal act is in force, and as a rule both parties are responsible for concluding it (paragraph 103, footnotes 42 and 43).<\/p>\n\n\n\n

What has to be established before signing<\/h2>\n\n\n\n

How to choose a provider before a data processing agreement is concluded<\/h3>\n\n\n\n

Recital 81 lists the provider’s expert knowledge, reliability and resources in particular as elements of the guarantees in Article 28(1). According to the EDPB, the assessment of the guarantees is a form of risk assessment and depends on the type of processing entrusted (paragraph 96). It often requires an exchange of documents, for example an information security policy or reports of external data protection audits and recognised certifications (paragraph 95). Adherence to an approved code of conduct (Article 40) or an approved certification mechanism (Article 42) may be used as an element to demonstrate the guarantees (Article 28(5)).<\/p>\n\n\n\n

\n\n

Remember<\/p>\n\n\n\n

A data processing agreement alone does not prove that the provider was assessed.<\/p>\n\n<\/div>\n\n\n\n

The President of UODO issued a reprimand to a hospital that had stopped at signing an agreement on the ready-made form of its email provider. The authority found an infringement of Article 28(1) because the provider had not been properly verified before and after the agreement was concluded. The hospital was therefore using a provider that did not provide sufficient guarantees (decision DKN.5131.12.2022 of 11 June 2026, final). The hospital had a provider assessment procedure but did not apply it to this choice. The provider held a certificate from the ISO\/IEC 27000 family of standards, which the hospital considered key, but the hospital did not formally assess it. The provider was also reprimanded, for the lack of appropriate security measures (Article 32(1) and (2) in conjunction with Article 28(3)(c)).<\/p>\n\n\n\n

According to the decision, the controller must have tangible evidence of the assessment carried out. According to the EDPB, the obligation in Article 28(1) is continuous. In the EDPB’s view the controller should verify the provider’s guarantees at appropriate intervals, including through audits and inspections where appropriate (paragraph 99).<\/p>\n\n\n\n

What a data processing agreement describes<\/h3>\n\n\n\n

The first sentence of Article 28(3) requires a description of the processing. According to the EDPB, the agreement should not merely restate the provisions of the GDPR (paragraph 112). It should specify how the requirements will be met and what level of security is required.<\/p>\n\n\n\n

According to the EDPB, the type of personal data and the categories of data subjects should be described as specifically as possible (paragraph 114). A mere reference to “personal data pursuant to Article 4(1) GDPR” is not adequate, and for special categories of data the agreement should at least specify which types of data are concerned. According to the EDPB, the duration of the processing is not necessarily the same as the duration of the agreement, as legal obligations may require the data to be kept longer or shorter (footnote 52).<\/p>\n\n\n\n

According to the EDPB, measures and procedures should be tailored to the specific situation, and there is no need to impose particularly stringent protections on processing from which only minor risks arise. In any event, however, the agreement must cover all elements of Article 28(3) (paragraph 113). According to the EDPB, the controller’s obligations include providing the data mentioned in the agreement and documenting instructions (paragraph 114). They also include supervising the processing, including through audits. The controller also gives the provider the security objectives from its own risk assessment and approves the measures proposed by the provider (paragraph 127). It decides on the main features of the measures and may leave the detailed measures to the provider (paragraphs 40 and 127).<\/p>\n\n\n\n

Provisions a data processing agreement must contain<\/h3>\n\n\n\n

The second sentence of Article 28(3) lists eight provisions that the agreement stipulates “in particular”, and the second subparagraph adds the obligation to inform about an instruction. The list is a minimum, and according to the EDPB the agreement may need further information depending on the risk (paragraph 115).<\/p>\n\n\n\n

Provision \u2014 basis<\/th>What to set out in the agreement<\/th>Exceptions and limitations<\/th><\/tr><\/thead>
Processing only on documented instructions \u2014 Article 28(3)(a)<\/td>the controller’s instructions, including with regard to transfers of personal data to a third country or an international organisation; the EDPB recommends annexing a procedure and a template for further instructions (paragraph 118)<\/td>exception where processing is required by Union or Member State law to which the processor is subject; the processor then informs the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest<\/td><\/tr>
Confidentiality of authorised persons \u2014 point (b)<\/td>commitment to confidentiality by persons authorised to process the data<\/td>an appropriate statutory obligation of confidentiality may apply instead of the commitment<\/td><\/tr>
Security \u2014 point (c)<\/td>all measures required pursuant to Article 32; according to the EDPB the agreement must include or reference information on the measures, an obligation to obtain the controller’s approval before changing them and a regular review (paragraph 126)<\/td>Article 32 also binds the processor directly (Article 32(1))<\/td><\/tr>
Sub-processor \u2014 point (d)<\/td>the conditions in Article 28(2) and (4)<\/td>prior specific or general written authorisation; the initial processor remains fully liable to the controller<\/td><\/tr>
Assistance with data subject requests \u2014 point (e)<\/td>how assistance is given by appropriate technical and organisational measures, for example by forwarding a request to the controller<\/td>assistance “taking into account the nature of the processing” and “insofar as this is possible”; the controller is responsible for responding to the request (paragraph 132)<\/td><\/tr>
Assistance with Articles 32\u201336 \u2014 point (f)<\/td>how assistance is given with the obligations in Articles 32\u201336; according to the EDPB it may be appropriate, depending on the processing, to specify the timeframe for breach notification and the point of contact as well as the modality and minimum content of the notification (paragraph 136)<\/td>assistance takes into account the nature of processing and the information available to the processor; the obligations remain the controller’s (paragraph 138)<\/td><\/tr>
Deletion or return of data \u2014 point (g)<\/td>the controller’s choice and deletion of existing copies; according to the EDPB also the possibility to change the choice before the end of the services (paragraph 140) and confirmation of deletion within an agreed timescale and manner (paragraph 141)<\/td>exception where Union or Member State law requires storage of the data<\/td><\/tr>
Information and audits \u2014 point (h)<\/td>information necessary to demonstrate compliance with the obligations in Article 28 and audits, including inspections, conducted by the controller or another auditor mandated by it<\/td>according to the EDPB the agreement should not provide for clearly disproportionate fees that discourage audits (paragraph 145)<\/td><\/tr>
Infringing instruction \u2014 second subparagraph of Article 28(3)<\/td>immediate information to the controller where, in the processor’s opinion, an instruction infringes data protection provisions<\/td>the EDPB recommends agreeing on the consequences of such information and of the controller’s inaction, for example suspending the instruction or terminating the agreement (paragraph 149)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Breach notification by the provider does not depend on the agreement. The processor notifies the controller without undue delay after becoming aware of a breach (Article 33(2)). The agreement may specify this obligation, for example with a deadline in hours and a notification channel. I recommend the wording “without undue delay and no later than 24 hours after becoming aware of the breach” with the right to supplement the information in phases. Notification in phases is also provided for in the Commission’s clauses (Clause 9.2), which do not set a deadline in hours. The content of the notification and work with the provider during an incident are discussed in the article How and when must a processor notify a personal data breach to the controller?<\/a>.<\/p>\n\n\n\n

A transfer of data to a third country also requires compliance with the conditions in Chapter V GDPR. According to the EDPB, the agreement should specify the requirements for such a transfer (paragraph 119).<\/p>\n\n\n\n

Sub-processor<\/h3>\n\n\n\n

A sub-processor is a subcontractor that processes data entrusted to the provider. It requires the controller’s prior specific or general written authorisation (Article 28(2)). According to the EDPB, a specific authorisation refers to a specific sub-processor for a specific processing activity at a specific time (paragraph 153). With a general authorisation, the processor informs the controller of any intended addition or replacement of other processors and gives it the opportunity to object.<\/p>\n\n\n\n

According to the EDPB, the main difference lies in the meaning given to the controller’s silence (paragraph 157). A request for specific authorisation not answered within the set timeframe should be held as denied (paragraph 155). With a general authorisation, failure to object within the set timeframe can be interpreted as authorisation. According to the EDPB, in both scenarios the agreement should set a reasonable timeframe for the decision, the means of communication and the steps following an objection (paragraph 158). According to the EDPB, with a general authorisation it is not sufficient to give access to a list of sub-processors updated from time to time without pointing to each new one (paragraph 128, footnote 54). The duty to inform stems from Article 28(2), and the EDPB recommends describing its procedure in the agreement (paragraph 128). Where the provider sends notifications only to subscribers, it is worth subscribing a team mailbox to these notifications.<\/p>\n\n\n\n

The same data protection obligations as in the agreement with the controller are imposed on the sub-processor, in particular the obligation to provide sufficient guarantees (Article 28(4)). According to the EDPB, this also includes allowing audits (paragraph 129). Under the Commission’s clauses, the provider gives the controller a copy of the sub-processor agreement on request and may redact confidential information to the extent necessary (Clause 7.7(c)). According to the EDPB, the obligations must be the same in substance rather than in wording. It adds that the whole chain of processing activities needs to be regulated by written agreements (paragraph 160).<\/p>\n\n\n\n

What form a data processing agreement takes and what to do with the provider’s template<\/h3>\n\n\n\n

The contract or other legal act is in writing, including in electronic form (Article 28(9)). According to the EDPB, a non-written agreement does not meet the requirements of Article 28, regardless of how thorough or effective it is (paragraph 101). Where the provider allows it, I recommend a handwritten signature or a qualified electronic signature. When accepting terms in a panel, it is worth keeping the accepted version and evidence of acceptance by a person authorised to conclude such agreements. Without such authority, the validity of the agreement depends on its confirmation by the organisation (Article 103 \u00a7 1 of the Polish Civil Code).<\/p>\n\n\n\n

The Civil Code links the written form to a handwritten signature (Article 78 \u00a7 1) and the electronic form to a qualified electronic signature (Article 78\u00b9 \u00a7 1). The Code’s provisions matter where the agreement is governed by Polish law.<\/p>\n\n\n\n

In my assessment, Article 28(9) requires the content of the agreement to be recorded and accepted by both parties, not the form defined in the Civil Code. The English wording of the Regulation says “in writing, including in electronic form” and does not refer to a national form. Paragraph 9 also covers another legal act such as a statute. The same words appear in Article 30(3) for the record of processing activities. Against this reading is the Polish version, which uses the Civil Code terms “forma pisemna” and “forma elektroniczna”. The EDPB recommends including the necessary signatures in line with applicable law to avoid difficulties in demonstrating that the agreement is in force (paragraph 101).<\/p>\n\n\n\n

Under the Civil Code reading, accepting terms in the provider’s panel gives at most the documentary form (Article 77\u00b2 of the Civil Code). Failure to observe a reserved written or electronic form results in invalidity only where the law provides for it under pain of nullity (Article 73 \u00a7 1 of the Civil Code), and Article 28(9) does not. Between businesses, the evidentiary restrictions arising from this do not apply either (Article 74 \u00a7 4 of the Civil Code). The risk is therefore mainly an allegation of infringing the GDPR, not invalidity of the agreement because of its form.<\/p>\n\n\n\n

Providers often present their own template as part of the terms of service. According to the EDPB, the fact that the provider prepares the agreement is not in itself problematic (paragraph 110). A weaker negotiating position does not justify accepting terms that do not comply with the law, nor does it discharge the controller from its obligations. The controller must evaluate the terms, and in so far as it freely accepts them and uses the service, it has accepted full responsibility for compliance with the GDPR. The provider should notify changes directly to the controller for approval, bearing in mind its leeway as to non-essential means of processing. According to the EDPB, the mere publication of changes on the provider’s website does not comply with Article 28 (paragraph 110). A modified standard form issued during a continuing contract may bind a party under civil law if it does not terminate the contract at the next termination date (Article 384\u00b9 of the Civil Code). This requires the conditions of Article 384 of the Civil Code, which outside consumer contracts do not always require delivery (Article 384 \u00a7 2). Being bound under civil law does not replace the controller’s assessment of the change, so it is worth closing that assessment with an explicit decision before that date. With a stronger position, it is worth agreeing the data processing agreement as a separate document and stating that a change in the terms of service does not change it. In the event of a conflict with the standard form, the parties are then bound by the agreement (Article 385 \u00a7 1 of the Civil Code).<\/p>\n\n\n\n

Standard contractual clauses instead of your own template<\/h3>\n\n\n\n

The agreement may be based in whole or in part on standard contractual clauses of the Commission or of a supervisory authority (Article 28(6)\u2013(8)). The Commission’s clauses were adopted by Implementing Decision (EU) 2021\/915. The decision states that they fulfil the requirements of Article 28(3) and (4) (Article 1 of the decision). In the event of a contradiction with provisions of related agreements between the parties, the clauses prevail (Clause 4). According to the EDPB, there is no obligation to use them and they are not necessarily to be preferred over an individual contract (paragraph 106).<\/p>\n\n\n\n

Parties using the clauses do not modify the data protection provisions but fill in the options and annexes (paragraph 107). They may add other clauses provided that these do not directly or indirectly contradict the clauses or detract from the fundamental rights or freedoms of data subjects (Clause 2(b)). Annex II contains the description of the processing. According to the explanatory note to Annex III, technical and organisational measures need to be described concretely and not in a generic manner. Clause 7.7 offers a choice between specific and general authorisation for sub-processors, and the parties fill in the notice period. If the parties adopt optional Clause 5, any entity such as a group company may accede to the clauses with the agreement of all the parties. The clauses do not by themselves ensure compliance with obligations related to transfers to third countries under Chapter V GDPR (Clause 1(f)).<\/p>\n\n\n\n

Audit, assistance and costs<\/h3>\n\n\n\n

According to the EDPB, the agreement sets out how often and how the provider supplies the information needed to demonstrate compliance with Article 28 (paragraph 143). The provider may suggest an auditor, but the final decision lies with the controller. The controller may also contest the scope, methodology and results of an audit performed by an auditor proposed by the provider (paragraph 144).<\/p>\n\n\n\n

According to the EDPB, the parties should cooperate in good faith in assessing the need for and the form of an audit at the provider, and the final choice lies with the controller (paragraph 144). After the audit, the controller should be able to request the remedying of shortcomings identified. Under the Commission’s clauses, audits are carried out at reasonable intervals or if there are indications of non-compliance, and the controller may take into account the provider’s certifications (Clause 7.6(c)). In practice, providers of mass-market services offer reports from independent audits. A report may supplement the controller’s audit, but the agreement should not exclude the right to audit. It is worth checking the scope and period of the report and the sub-processors excluded from it. Separately, it is worth assessing any exceptions noted by the auditor and the controls assigned to the customer.<\/p>\n\n\n\n

According to the EDPB, the GDPR does not cover the allocation of audit costs and leaves it to the parties, subject to the limit of clearly disproportionate fees (paragraph 145). Article 28(3)(e) and (f) does not say who pays for assistance with data subject requests and breaches either. It is worth settling this in the main contract together with the provider’s response time. According to the EDPB, the controller cannot extend the deadlines in Chapter III on the ground that the necessary information must come from the provider (paragraph 132).<\/p>\n\n\n\n

When a provider goes beyond its role<\/h3>\n\n\n\n

A processor that infringes the GDPR by determining the purposes and means of processing is considered to be a controller in respect of that processing (Article 28(10)).<\/p>\n\n\n\n

Under the GDPR, a processor is liable for the damage caused by processing only where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller (Article 82(2)). Documented instructions help it show that it acted within them. According to the EDPB, obligations imposed directly on the processor also stem from Article 28(3) (paragraph 93).<\/p>\n\n\n\n

Where to start when a data processing agreement already exists<\/h3>\n\n\n\n

It is worth starting the review with the record of processing activities and comparing it with the list of contracts and IT services. The record requires only the categories of recipients (Article 30(1)(d)), so the names of providers have to be taken from contracts and invoices. The order of the review is set by risk, for example special categories of data, a large number of people or transfers to a third country. Contracts concluded before 25 May 2018 should have been updated in light of Article 28(3), and according to the EDPB the absence of such an update infringes that provision (paragraph 103).<\/p>\n\n\n\n

The list of providers and their roles is usually established by the process owner with the data protection officer, and a lawyer reviews the template agreement. With several hundred providers, costs are kept down by dividing them into risk groups with full negotiation only in the highest group. The other agreements only need to be compared with the table of provisions. The result of the review is a list of providers with their role and risk group and a list of deviations from your own standard for the board’s decision.<\/p>\n\n\n\n

Where the provider’s template does not contain all the elements of Article 28(3), it has to be supplemented with an annex or a separate agreement, because the agreement must cover all those elements (paragraph 113). Where the provider does not allow this, you can propose the Commission’s clauses, which according to the EDPB may contribute to rebalancing negotiating positions (paragraph 109). The last resort is changing the provider. Your own standard means the organisation’s requirements beyond Article 28(3), for example the breach notification deadline or data location. Deviations from it are worth submitting to the board for approval, while gaps against Article 28(3) have to be removed before signing or by an annex. It is worth recording the result of the assessment, because the controller must be able to demonstrate compliance (Article 5(2) and Article 24(1)).<\/p>\n\n\n\n

Common mistakes<\/h2>\n\n\n\n