Data processing agreement: what to review before you sign

Published 5 November 2026

Summary: Before you sign a data processing agreement, check that it covers every requirement in GDPR Article 28(3) and describes how each one is met in your processing, rather than repeating the law. Look closely at sub-processors, help with personal data breaches and data subject requests, what happens to the data at the end and your right to audit. Each transfer outside the EU/EEA needs a basis in Chapter V. For ongoing supplier transfers that is normally an adequacy decision or appropriate safeguards, for example Standard Contractual Clauses with a documented transfer assessment. The derogations in Article 49 are meant for specific situations and are not a normal solution for ongoing outsourcing. Standard terms from the supplier do not move the responsibility away from you.

Why the review is your responsibility

Under Article 28(1), you as the controller may only use processors that provide sufficient guarantees that the processing will meet the requirements of the GDPR and protect the rights of the data subjects. You must assess those guarantees and be able to show that you have done so. The agreement must be in writing, which under Article 28(9) includes electronic form.

According to the Guidelines 07/2020 of the European Data Protection Board (EDPB), the guarantees that count are those the supplier can demonstrate, for example with an information security policy, external audit reports or certifications in the ISO 27000 series. A certification is part of the evidence but does not replace the agreement. The assessment should also be repeated at appropriate intervals.

In our division of the GDPR into 15 parts, this belongs to part 12, suppliers and transfers.

What the agreement must contain under Article 28(3)

The agreement must set out the subject-matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and your obligations and rights. On top of that, eight points must be covered. According to the EDPB, the agreement should describe concretely how the requirements are met in the processing in question, not merely restate the Regulation.

Requirement in Article 28(3)	What you check
(a) Documented instructions	Processing only on your documented instructions, including for transfers to third countries. Watch for terms letting the supplier use the data for its own purposes: under Article 28(10), a processor that determines purposes and means becomes the controller for that processing.
(b) Confidentiality	Everyone processing the data is committed to confidentiality or under a statutory obligation of confidentiality.
(c) Security under Article 32	Security measures described concretely enough for you to assess them, often in an annex. A reference to “Article 32” is not enough.
(d) Sub-processors	The conditions in Article 28(2) and 28(4), see the next section.
(e) Data subject rights	How the supplier helps you answer requests. Your deadlines are not extended while you wait for the supplier.
(f) Articles 32–36	Help with security, personal data breaches and impact assessments. The supplier must notify you of a breach without undue delay. As you must notify IMY (the Swedish Authority for Privacy Protection), where feasible within 72 hours, the agreement should set a time limit in hours, a point of contact and the content of the notification.
(g) Deletion or return	You choose deletion or return when the service ends, copies are deleted unless the law requires storage, and the deletion is confirmed.
(h) Information and audits	The information needed to demonstrate compliance, and audits, including inspections, by you or an auditor you appoint.

Sub-processors: a list, advance notice and the right to object

Under Article 28(2), the supplier may not engage a sub-processor without your prior written authorisation, which may be specific or general. Under a general authorisation, the supplier must inform you of intended additions or replacements so that you can object. Under Article 28(4), the sub-processor must have the same data protection obligations, and the supplier remains fully liable to you for their performance. Check that the agreement sets out:

• a list of approved sub-processors showing where they are and what they do;
• how far in advance you are told about changes; under a general authorisation, according to the EDPB, the supplier must actively inform you of each new sub-processor so that you can object, not just update a list;
• how long you have to object and what happens then, for example that you may terminate the service;
• the transfer basis for sub-processors outside the EU/EEA.

Transfers outside the EU/EEA: adequacy decision or Standard Contractual Clauses

Under Article 44, personal data may only be transferred to a third country, including onward, if the conditions in Chapter V are met. Remote access from a third country can also be a transfer, when personal data is made available to another party there, for example a sub-processor providing support. The same applies to storage with a cloud provider outside the EEA. Your own employee accessing the data remotely from a third country, on the other hand, is not in itself a transfer under Chapter V, although the risks still need to be managed. That is how the EDPB describes it in Recommendations 01/2020 and Guidelines 05/2021. So ask from where the data is accessed and by whom, not only where it is stored.

When an adequacy decision applies to the recipient

If the European Commission has decided that the country ensures an adequate level of protection, no specific authorisation is needed (Article 45). For the United States, Implementing Decision (EU) 2023/1795 on the EU–U.S. Data Privacy Framework of 10 July 2023 applies, but only to organisations on the Data Privacy Framework List maintained by the U.S. Department of Commerce. Check that the recipient itself is on it. No transfer assessment is then needed, but the usual assessment of the supplier, the data processing agreement and security still applies, and you need to follow whether the decision is repealed or invalidated.

On 3 September 2025, the General Court dismissed an action to annul the decision (Case T-553/23). The judgment has been appealed to the Court of Justice (Case C-703/25 P), which had not decided the case when we checked on 3 October 2026.

When you rely on Standard Contractual Clauses

Without an adequacy decision, or if the recipient is not on the list, appropriate safeguards under Article 46 are needed, for example the Commission’s Standard Contractual Clauses under Implementing Decision (EU) 2021/914.

The clauses are not enough on their own. Under Clause 14, the parties must assess whether the laws and practices in the destination country, such as public authorities’ access to the data, prevent the recipient from complying with the clauses, and document the assessment so that it can be shown to the supervisory authority. It is often called a transfer impact assessment, or TIA, and the EDPB describes it in six steps, including supplementary measures where needed. For US recipients not on the list, IMY says you may take the Commission’s assessment in the adequacy decision into account.

When the agreement is the supplier’s standard terms

With some suppliers, the data processing agreement is part of standard terms that cannot be negotiated. According to the EDPB, that is not a problem in itself, but a small organisation’s weak negotiating position is no reason to accept non-compliant terms, and whoever accepts them and uses the service has accepted full responsibility. When you cannot change the text:

• read the agreement, the security annex and the list of sub-processors against the table above, and document your assessment;
• check how changes to the agreement itself are announced: according to the EDPB, the supplier must notify proposed changes to you directly for approval, with some leeway in details that are not essential to the processing, and publication on the supplier’s website alone does not comply with Article 28 (changes of sub-processors work as described in the section on sub-processors);
• accept a third-party audit report if it gives you what you need, but keep the final decision on the auditor; according to the EDPB, audit fees should not be so high that the right becomes theoretical;
• reduce the personal data in the service, or choose another supplier, if the terms are not sufficient.

Checklist before you sign

1. Establish that the supplier processes the data on your behalf, not for its own purposes.
2. Ask for evidence of the supplier’s guarantees: a security description, audit reports and certifications.
3. Check the agreement against the eight points in Article 28(3) and against how you will use the service.
4. Map where the data is stored and accessed from, note the basis for each transfer outside the EU/EEA and document a transfer assessment where you rely on Standard Contractual Clauses.
5. Check the time limit for breach notifications and who receives them on your side.
6. Add the supplier to your record of processing activities and set a follow-up date.

When the review is done, you have a signed agreement with completed annexes, a documented assessment of the supplier, a known basis for each transfer and a date for the next follow-up.

Would you like help reviewing your data processing agreements and transfers? Read about our work with data protection and privacy, about ongoing GDPR support, in which new data processing agreements are reviewed before they are signed, or contact us.

Sources: Regulation (EU) 2016/679 (GDPR), Articles 28, 33, 44–46 and 49; EDPB Guidelines 07/2020 on controller and processor; EDPB Recommendations 01/2020 on supplementary measures; EDPB Guidelines 05/2021 on the interplay between Article 3 and Chapter V; Commission Implementing Decisions (EU) 2021/914 and (EU) 2023/1795; General Court, Case T-553/23, and the appeal, Case C-703/25 P; IMY on data processing agreements and on transfers to the United States. Verified 2026-10-03.

This text is general information and not legal advice. The legal position on transfers to the United States can change, so check the current position before you decide.