--- title: "Data Processing Agreements | Pitch" description: "Article 28 GDPR agreements drafted, reviewed and negotiated for controllers and processors, including sub-processors and international transfers." url: https://www.pitch.law/solutions/data-processing-agreements --- [pitch](https://www.pitch.law/) [Solutions](https://www.pitch.law/solutions) [Privacy & Data Protection](https://www.pitch.law/solution-categories/privacy) # Data Processing Agreements Article 28 GDPR agreements drafted, reviewed and negotiated for controllers and processors, including sub-processors and international transfers. - By By Bart Lieben, Attorney-at-Law - Published 21 February 2023 - 360 stage: Protect ## The question A supplier sends you its data processing agreement with a request to sign. A customer asks you to sign theirs. Is it adequate, and what should you ask to change? Article 28 GDPR requires a binding contract whenever a processor handles personal data on behalf of a controller. The contract must set out the subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects. It must oblige the processor to act only on documented instructions, to ensure confidentiality, to apply the security measures of Article 32, to respect the conditions for engaging sub-processors, to assist with data subject requests and with breach notification and impact assessments, to delete or return data at the end, and to allow audits. Most agreements on the market contain those clauses. The problems lie elsewhere: a vague description of the processing, a security annex that says nothing, a sub-processor list nobody maintains, a transfer clause that no longer matches reality, or a role that is wrongly qualified. A processor that decides on purposes and means itself becomes a controller (Article 28(10)), and two parties who decide together are joint controllers under Article 26, which needs a different arrangement. ## Our approach We begin with the relationship, not the form. Who decides why the data is processed? Which data, which systems, which sub-processors, which countries? That determines whether you need a controller-to-processor agreement, a joint controller arrangement or a controller-to-controller allocation. We then draft or review. For your own agreements we use [our Document Studio](https://www.pitch.law/technologies/contract-studio), which builds the document from a fixed structure and our clause library and produces a Word file in the house style. For a supplier's agreement we check each clause against Article 28(3) and against what the supplier actually does, and we propose changes in order of importance, so that you negotiate on the points that matter. Where data leaves the European Economic Area, we check the transfer basis: an adequacy decision, the standard contractual clauses or another instrument, together with the assessment that goes with it. [International data transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) explains the framework. The agreement should also state retention and deletion in a way that can be carried out (see [how long personal data may be kept](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data)). Finally, we connect the agreement to your records. The processor and the agreement are entered in [your register](https://www.pitch.law/technologies/privacy-register), which is what [Article 30](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) expects, and renewal and sub-processor changes are followed on the compliance calendar. A lawyer reviews every agreement before it is sent or signed. Typical triggers are a new SaaS or cloud supplier, a large customer that sends its own DPA as a condition of the contract, a supplier audit that finds agreements missing for half of your processors, a move of hosting to a provider outside the EEA, or the preparation of a financing round or sale in which the buyer asks for your data protection documents. ## What you get - A processing agreement with annexes that describe the real processing, the security measures, the sub-processors and the transfers. - For supplier agreements: a clause-by-clause review with a prioritised list of requested changes and, where useful, our negotiation with the other side. - A short note on the roles of the parties (controller, processor, joint controllers) and why. - Documents prepared for your own recurring use, so that your team does not start from a blank page each time. - The processor entered in your register with the agreement attached. Limits apply. An agreement cannot repair processing that has no lawful basis, and a clause cannot make a transfer lawful if the destination country's law undermines it. We will tell you when the answer lies outside the contract. A Leuven software company hosts customer data with a cloud provider and uses a support-ticket tool from a US vendor. Both vendors sent standard DPAs. Our review found that the cloud provider's agreement allowed sub-processors to be added with notice only after the event and gave no audit right, and that the support vendor's annex listed data categories the company never sends. We proposed prior notice with a right to object, an audit clause limited to reports and certificates, a corrected annex and a fallback to standard contractual clauses. The vendors accepted most points, and the final versions were entered in the register with their sub-processor lists. ## Next step Send us the agreement you are asked to sign, or a list of the suppliers who process personal data on your behalf. We will tell you what needs to change and what can stay. [Schedule a meeting](https://www.pitch.law/schedule) or [contact us](https://www.pitch.law/contact-us). ## In short - Article 28 GDPR agreements that fit the real processing - Review and negotiation of supplier DPAs - Sub-processing chains and transfers addressed - Linked to your record of processing - Reviewed by a lawyer ## Technology we use - [Technology](https://www.pitch.law/technologies/contract-studio) ### [Document Studio](https://www.pitch.law/technologies/contract-studio) [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://www.pitch.law/technologies/contract-studio) - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) ## Background reading - [Academy](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) ### [International Data Transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) [How Chapter V GDPR works after Schrems II: adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses and the assessment that goes with them.](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) - [Academy](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) ### [How Long May You Keep Personal Data?](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) [The storage limitation principle in Article 5(1)(e) GDPR, how to set retention periods and how to delete in practice.](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) - [Academy](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) ## More in Privacy & Data Protection - ### [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) - ### [Data Breach Response](https://www.pitch.law/solutions/data-breach-response-enforcement) [Help from the first hours of a personal data breach: assessment, notification to the authority and individuals, documentation, and action against the source.](https://www.pitch.law/solutions/data-breach-response-enforcement) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)