Data Processing Agreement (DPA)

What does a data processing agreement (DPA) govern?

The data processing agreement specifies what the service provider may and must do with the data entrusted to it. Art. 28(3) GDPR prescribes a fixed catalogue of minimum content that is non-negotiable – if any of it is missing, the contract is incomplete and the processing is open to challenge.

Matters that must be regulated include: the subject matter, nature, purpose, and duration of the processing; the categories of data subjects and types of data; the processor's exclusive obligation to act on instructions; the confidentiality commitment of the staff involved; the technical and organisational measures (TOMs) to be taken; the rules on the use of sub-processors; duties to assist with data subject rights and reporting obligations; and the deletion or return of the data at the end of the contract.

Controller vs. processor: defining the roles

The central distinction in data protection law is the question of who decides on the purposes and means of the processing. Whoever does so is the controller (Art. 4(7) GDPR). Whoever processes data only on external instructions and without any decision-making scope of their own is a processor (Art. 4(8)).

Data processing on behalf must be distinguished from joint controllership (Art. 26 GDPR), where two parties jointly determine the purposes and means, and from transfer to an independent controller. A classic example of the latter: a tax advisor or auditor processes client data by virtue of their own professional duties – here there is precisely no instruction-bound processing on behalf, but rather a transfer to a further controller, for which no DPA is needed but a separate legal basis is. Incorrect classification regularly leads to invalid contracts and liability gaps.

Why a data processing agreement (DPA) matters

Without a valid DPA, any disclosure of personal data to a service provider is unlawful – regardless of how carefully that provider actually works. Supervisory authorities regularly check the existence and completeness of DPAs as "low-hanging fruit", because it can be verified quickly and without technical analysis.

Breaches of Art. 28 GDPR carry fines of up to EUR 10 million or 2% of worldwide annual turnover under Art. 83(4) GDPR. On top of that come reputational risks and potential compensation claims from data subjects. For the controller, the DPA is also an instrument of proof: in line with the accountability principle (Art. 5(2) GDPR), it documents that processing by third parties is controlled and safeguarded.

Not least, a well-maintained DPA also protects your own business: it forces both sides to clarify responsibilities, access paths, and reporting chains before the first exchange of data. If a data breach occurs, this shortens the response time and considerably facilitates timely notification to the supervisory authority under Art. 33 GDPR.

Data processing on behalf in the ERP system

A modern ERP processes large volumes of personal data: customer and supplier master data, contacts, order and delivery histories, and sometimes employee data too. If the ERP is operated as a cloud ERP or SaaS, this data resides on the provider's infrastructure – which almost always makes the provider a processor with whom a DPA must be concluded.

Several ERP topics are relevant in practice: data residency (in which country or data centre the data is stored and whether a third-country transfer takes place), the permissions and roles concept, audit-proof logging of access via an audit trail, and a clean deletion concept that technically implements the deletion or return of the data at the end of the contract. Connected subsystems too – shop, CRM, shipping provider, payment provider – each establish their own data processing relationships, which should be recorded in the record of processing activities.

DACH specifics and implementation

In Germany, the Federal Data Protection Act (BDSG) supplements the GDPR; in Austria, the Data Protection Act (DSG) does so. Switzerland is not subject to the GDPR but to the revised Data Protection Act (revDSG, in force since September 2023); it too provides for processing on behalf with very similar requirements in Art. 9. Anyone operating across borders must keep both regimes in view.

A frequent pitfall is data transfer to third countries, such as the USA. Here, additional appropriate safeguards such as EU Standard Contractual Clauses (SCCs) or certification under the EU-US Data Privacy Framework are required. For practical implementation, it is advisable to manage DPAs centrally, keep track of changes to sub-processors, and review the TOMs regularly – ideally supported by provider certifications such as ISO 27001.