When do you need a data processing agreement?
Under the GDPR you are the controller: you decide why and how personal data is used. A party that processes personal data on your behalf is a processor. You must sign a data processing agreement with every processor.
When you have software built, the developer is often a processor. That is the case when they:
- host or maintain the software, with your customer or staff data in it;
- look into the production database for incidents or questions;
- move data from your old system to the new one;
- manage integrations that personal data passes through.
If someone only builds software and never touches real data, no agreement is needed. In practice that is rare, especially when the same party also handles maintenance.
What must it contain under the GDPR?
Article 28 of the GDPR lists what a data processing agreement must at least cover:
- 01Subject, duration, nature and purpose of the processing.
- 02Which personal data is involved, and whose: customers, staff, patients.
- 03That the processor only acts on your documented instructions.
- 04Confidentiality for everyone with access to the data.
- 05Appropriate security, such as encryption, access rights and backups.
- 06Rules for sub-processors: the processor only engages other parties with your permission, and imposes the same obligations on them.
- 07Help with data subject rights, such as a request for access or deletion.
- 08Help with security and data breaches, and with a data protection impact assessment (DPIA) when one is needed.
- 09What happens at the end: the data is returned or deleted.
- 10Information and audits: you may have compliance with the agreement checked.
What else should you check for software?
Besides the required points, some agreements make the difference for software:
- Where the data is stored. Hosting in the EU keeps it simple. If data goes outside the EU, extra safeguards are needed.
- Which sub-processors there are. Ask for a list: hosting, database, email, monitoring, and any AI services.
- How quickly a breach is reported. You must report a serious breach to the regulator within 72 hours. So agree that the processor tells you well before that, for example within 24 hours.
- Who has access to production data, and whether that access is logged.
- Test data. Agree that no real personal data is used for development and testing, unless there is no other way.
- AI services. If data goes to an AI service, record which one, for what, and that the service does not use it to train models.
Who drafts the agreement?
Either party may. Many organisations use their own template. A good developer will also have a template ready and an up-to-date list of sub-processors. Either way, read it carefully and make sure it matches how the software is actually built. This article is general information, not legal advice; if you are unsure about your situation, ask a privacy lawyer to review it.
In summary
- If a developer or maintainer processes personal data on your behalf, a data processing agreement is required.
- Article 28 GDPR sets out what it must contain: instructions, security, sub-processors, breach support and the end of the contract.
- For software, also check EU hosting, the breach reporting time, test data and AI services.
Frequently asked questions
Yes, size does not matter. As soon as a party processes personal data on your behalf, an agreement is required.
Yes. If the software runs at a hosting provider, that provider is a (sub-)processor. It belongs on the list of sub-processors in the agreement.
Then you do not comply with the GDPR, and the regulator can impose a fine. More importantly, without agreements you cannot be sure what happens to the data.