Question 1

When do I need a Data Processing Agreement (DPA)?

Accepted Answer

Under GDPR Article 28, a Data Processing Agreement is required whenever a data controller engages a data processor — a third party that processes personal data on your behalf. Common examples: cloud hosting providers (AWS, Google Cloud, Azure); email marketing platforms (Mailchimp, Brevo); CRM systems (Salesforce, HubSpot); payment processors (Stripe, PayPal when they process cardholder data for you); HR software; analytics platforms. The DPA must be a written contract (including electronic format). Many large platforms provide their own DPA — you must review and accept it. GDPR Article 28 requires the DPA to specify: subject matter, duration, nature and purpose of processing, type of personal data, categories of data subjects, and obligations and rights of the controller.

Question 2

What are the key GDPR data processing principles?

Accepted Answer

GDPR Article 5 sets out seven data processing principles: (1) Lawfulness, fairness and transparency: you must have a lawful basis (Article 6), be fair and tell people what you do with their data. (2) Purpose limitation: collect data only for specified, explicit and legitimate purposes; do not process it in a way incompatible with those purposes. (3) Data minimisation: collect only what is necessary for the stated purpose — do not collect data 'just in case.' (4) Accuracy: keep data accurate and up to date. (5) Storage limitation: do not keep data longer than necessary — define and document retention periods. (6) Integrity and confidentiality (security): appropriate technical and organisational measures to protect data from unauthorised access, loss or destruction. (7) Accountability: the data controller is responsible for and must be able to demonstrate compliance with all of the above.

Question 3

What must a Data Processing Agreement include under GDPR?

Accepted Answer

Under GDPR Article 28, a Data Processing Agreement must include: (1) Processing only on documented instructions from the controller; (2) Confidentiality obligations for personnel who process data; (3) Appropriate security measures (Article 32); (4) Sub-processor restrictions — the processor must not engage sub-processors without the controller's prior written authorisation; (5) Assistance with data subject rights requests; (6) Assistance with security, breach notification, DPIAs and consultation with supervisory authorities; (7) Deletion or return of all personal data on termination; (8) Making available all information necessary to demonstrate compliance; (9) Allowing and contributing to audits by the controller. Missing any of these elements means the agreement does not comply with GDPR Article 28 — both parties can be fined.

Question 4

What is a DPIA and when is it required?

Accepted Answer

A Data Protection Impact Assessment (DPIA) is a process to identify and minimise data protection risks. Under GDPR Article 35, a DPIA is mandatory before processing that is 'likely to result in a high risk' to individuals. Mandatory triggers include: systematic and extensive profiling; processing special category data on a large scale; systematic monitoring of publicly accessible areas (e.g. CCTV). The ICO (UK) and national DPAs publish lists of processing operations that require a DPIA. A DPIA must: describe the processing and its purposes; assess necessity and proportionality; identify risks; and identify measures to mitigate them. If high risks remain after mitigation, you must consult your supervisory authority before processing. Best practice: conduct a DPIA for any new product or feature that involves significant processing of personal data, even if not legally required.

GDPR clause	Requirement	Article
Purpose limitation	Process data only for specified purposes; no incompatible secondary use	Art. 5(1)(b)
Data minimisation	Collect only what is necessary — no data "just in case"	Art. 5(1)(c)
Retention & deletion	Define and document how long each data type is kept; delete or anonymise after	Art. 5(1)(e)
Security measures	Implement appropriate technical and organisational security measures	Art. 5(1)(f) + Art. 32
Processor obligations	Processor acts only on controller's documented instructions; cannot engage sub-processors without authorisation	Art. 28
Data subject rights	Processor assists controller in responding to access, erasure and other rights requests	Art. 28(3)(e)

GDPR Clauses Generator

Core GDPR data processing clauses

Frequently asked questions

Related tools

Handle personal data with confidence and compliance