A data processing agreement (DPA) is the contract GDPR requires when one organisation processes personal data on behalf of another. It is set out in Article 28 GDPR. The DPA binds the service provider (the processor) to act only on the customer's instructions (the controller), keep the data secure, use approved sub-processors only, and delete or return the data at the end. Without one, using a cloud tool with personal data is usually a GDPR breach.
An everyday example
A law firm, "Becker & Partner", starts using a cloud tool to draft letters and summarise case files. Client names, case details and correspondence go into it.
- The law firm decides why and how client data is used. It is the controller.
- The cloud tool handles the data only to provide the service. It is the processor.
- The tool runs on a hosting provider and calls an AI model provider. Those are sub-processors.
Before any client file goes in, the firm signs a DPA with the tool provider, and the provider in turn has DPAs with its sub-processors. That chain is what keeps the data within the firm's control on paper.
The details, simply
Controller vs processor
- Controller (Art. 4(7)): decides the purposes and means of processing. It carries the main responsibility under GDPR.
- Processor (Art. 4(8)): processes personal data on behalf of the controller, and only as instructed.
The label depends on what a company actually does, not what the contract calls it. If a processor starts deciding its own purposes for the data, for example using it to improve its own products, it is treated as a controller for that processing (Art. 28(10)), with all the duties that come with it.
What a DPA must contain (Art. 28(3))
The contract must set out the subject matter, duration, nature and purpose of the processing, the types of personal data and categories of people, and the controller's rights and obligations. The processor must:
- Process the data only on documented instructions from the controller.
- Ensure everyone authorised to process the data is bound to confidentiality.
- Take appropriate security measures (Art. 32).
- Use sub-processors only with the controller's authorisation, and pass on the same obligations to them.
- Help the controller respond to data subject requests (access, erasure and so on).
- Help with security, breach notification and impact assessments.
- Delete or return all personal data at the end of the service.
- Make available the information needed to demonstrate compliance, and allow audits.
The European Commission has published standard contractual clauses for Art. 28 that many providers use as a template. In different countries the same document has different names: AVV in Germany, verwerkersovereenkomst in the Netherlands.
Who needs one
Any controller that uses a processor for personal data: a practice using cloud software, a company using a payroll provider, a firm using an AI tool. Both sides are responsible for having it in place.
This is general information, not legal advice.
What a DPA does not cover
A DPA is essential, but it is narrower than many people assume.
- It covers processing on your behalf, nothing else. Many providers sign a DPA for the core service and, in their general terms, also act as a controller for "their own purposes": product improvement, analytics, security research or model training. The DPA does not restrict what they do in that controller role.
- Licences live in the terms, not the DPA. Terms of service often grant a broad licence to "use, reproduce, modify and create derivative works" from your content, or to create aggregated or de-identified data from it. Read both documents together.
- Anonymised data falls outside it. The DPA governs personal data. Once a provider is allowed to anonymise your content, the result is no longer personal data (GDPR Recital 26), and it can be reused or sold without restriction. See pseudonymisation vs anonymisation.
- It does not replace your own legal basis. For professionals bound by secrecy, such as doctors or lawyers, what makes disclosure lawful is typically the client's or patient's consent or another legal permission. That stays with you.
We show how data with the name removed can travel further, step by step, on the data trail, with the legal mechanism set out on legal to sell.
What this means when you use AI tools
When you review an AI provider, check:
- Is there a signed DPA, and does the chain reach the AI model provider, not only the app?
- Is the provider a processor for everything, or a controller for some purposes?
- Do the terms of service grant a licence to use, aggregate or anonymise your content?
- Training and retention: is your content ever used to train models, and how long is it kept, by every party in the chain?
Wysor acts only as your processor under Art. 28 GDPR, on your instructions. We take no licence to reuse your content; we process it only to run the service for you. We never train on it and never sell it, anonymised or not. Those commitments are in the contract, and they bind anyone who could ever own Wysor. Data is encrypted in transit and at rest and hosted in the EU, and every connected AI model provider runs with zero data retention. Our GDPR AI compliance checklist walks through the full review.
FAQ
What is a DPA agreement? A DPA (data processing agreement) is the contract under Art. 28 GDPR between a controller and a processor. It sets out how the processor may handle personal data on the controller's behalf, and the safeguards it must apply.
What is the difference between a data processor and a controller? The controller decides why and how personal data is processed. The processor handles it on the controller's behalf and only on its instructions. A processor that starts using the data for its own purposes becomes a controller for that processing.
Is a DPA mandatory under GDPR? Yes, whenever a processor handles personal data for a controller. Art. 28(3) requires a contract or other legal act with specific minimum content.
Does a DPA stop a provider from training AI on my data? Only for processing it covers. If the provider's terms let it act as a controller for model improvement, or let it create anonymised data from your content, the DPA may not stop that. Check both the DPA and the terms.
What is a sub-processor? A company the processor engages to help deliver the service, such as a hosting or AI model provider. The processor needs the controller's authorisation and must pass on the same data protection obligations.
Further reading
- What is GDPR? A simple explanation
- Does ChatGPT sell your data?
- Complete privacy, by contract
- GDPR fines: how much, for what, and how they are calculated
- Legal to sell
Questions about our DPA? Reach us at [email protected] or through the in-app contact form.
