What is a data processing agreement?
A data processing agreement is the contract that governs the personal data a provider handles for its client. When a French company gives you its customers’ or employees’ data to host, analyse, email or support, it is the controller, you are its processor, and EU law fixes what your contract must say.
Why the GDPR makes it mandatory
Article 28 of the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, checked October 2026, requires processing by a processor to be governed by a contract or other legal act that binds the processor to the controller, in writing, electronic form included (article 28(9)). The duty runs both ways: article 83(4) exposes controllers and processors alike to fines for breaching their obligations under articles 25 to 39, article 28 among them.
One document, several names
DPA, data processing agreement, data processing addendum: the last name comes from where the DPA usually sits, attached to a services agreement or to terms of service. In French it is a contrat de sous-traitance, in which the processor is the sous-traitant and the controller the responsable du traitement. The content of article 28 matters, not the name. Where the DPA sits among a French client’s other expectations is explained in the guide to doing business in France.
Are you the controller or the processor?
You are the processor when you handle the data for your client’s purposes. Under article 4(7) and (8) of the GDPR, the controller, alone or jointly with others, determines the purposes and means of the processing; the processor processes personal data on its behalf.
The test: who decides why and how
A SaaS platform storing a client’s customer records, an agency emailing the client’s mailing list, a freelance developer with access to a production database: each works for the client’s purposes and is, for that data, a processor. The size of the provider and the author of the contract do not change the answer. The facts do.
Both at once, or jointly
A SaaS provider is often both: processor for the data its client uploads, controller for its own billing and marketing data. Two businesses that decide together are joint controllers, bound by an arrangement under article 26 rather than by a DPA.
What must a DPA contain?
A description of the processing and the eight obligations of article 28(3), points (a) to (h). Leave one out and the DPA does not meet the article.
The description of the processing
The contract sets out the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller (article 28(3)). In practice this is an annex: what your service does with the data, for how long, which data and whose. It decides what the rest of the contract covers.
The eight obligations
| Clause | What it means for you | GDPR article |
|---|---|---|
| Instructions | You act only on the client’s documented instructions, transfers included, unless the law requires otherwise | Article 28(3)(a) |
| Confidentiality | Everyone you authorise to process the data is bound to confidentiality | Article 28(3)(b) |
| Security | You take the measures required by article 32 | Article 28(3)(c) |
| Sub-processors | Prior written authorisation, and the same obligations passed down | Article 28(3)(d), 28(2) and 28(4) |
| Rights requests | You help the client answer people exercising their rights, as far as possible | Article 28(3)(e) |
| Security, breaches, assessments | You help the client meet articles 32 to 36, given the information you hold | Article 28(3)(f) |
| End of the service | You delete or return the data at the client’s choice, and delete the copies | Article 28(3)(g) |
| Information and audits | You show compliance and allow for audits, inspections included, by the client or its auditor | Article 28(3)(h) |
Article 28(3) adds one more duty: you must immediately inform the controller if, in your opinion, an instruction infringes data protection law. Silence is not neutral.
How do sub-processors fit into the chain?
Your hosting provider, email service and support tool are sub-processors. The GDPR allows them on two conditions: the client’s written authorisation, and a contract that passes your obligations down.
Your client instructs you; you impose the same obligations on each sub-processor. Breach notices and assistance travel back up to the client, and a sub-processor outside the EU adds a transfer.
Specific or general authorisation
Article 28(2) requires the controller’s prior specific or general written authorisation. Specific means a yes for each sub-processor. General means an agreed list, with a duty to inform the client of any intended addition or replacement so that it can object; the contract fixes the notice you give.
The same obligations, and full liability
Article 28(4) requires the same data protection obligations to be imposed on the sub-processor by contract, and leaves you fully liable to the client if it fails. Where your vendors’ standard terms promise less than you promised the client, the gap is yours.
What do security and breaches require of you?
Security appropriate to the risk, and speed when something goes wrong. The GDPR sets the standard; the DPA turns it into measures, contacts and deadlines.
Security is a standard, not a checklist
Article 32 requires measures that ensure a level of security appropriate to the risk, given the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. Its examples: pseudonymisation and encryption, the confidentiality, integrity, availability and resilience of systems, restoring access after an incident, and regular testing. The security annex of the DPA describes yours.
Breaches, and the hours your client asks for
You notify the controller of a personal data breach without undue delay after becoming aware of it (article 33(2)); the GDPR sets no number of hours for the processor. Your client must notify its supervisory authority, in France the CNIL, without undue delay and, where feasible, within 72 hours of becoming aware of it (article 33(1)). Hence a client’s request for 24 or 48 hours: a contractual deadline, not a legal one.
Can you use a data processing agreement template?
Yes: the European Commission wrote one. Under article 28(7), it adopted standard contractual clauses in Commission Implementing Decision (EU) 2021/915, in force on EUR-Lex in October 2026, and article 28(6) allows a DPA to be based on them in whole or in part.
What the Commission’s clauses do
They follow article 28 point by point, from instructions to termination. The parties undertake not to modify them, except to complete or update the annexes, but may place them in a broader contract and add clauses that do not contradict them (Clause 2). They do not by themselves ensure compliance with the transfer rules (Clause 1).
The annexes are the contract
The substance sits in four annexes: the parties, the description of the processing, the technical and organisational measures and, for specific authorisation, the sub-processors. The note to Annex III requires the measures to be described concretely, not generically. Even the notice before a new sub-processor is a blank. A template saves drafting; it answers none of your questions.
What changes when data leaves the EU?
A transfer to a processor or sub-processor outside the EU must also meet Chapter V of the GDPR, articles 44 to 49, which binds controllers and processors alike, onward transfers included (article 44).
| Where the processor or sub-processor is | What allows the transfer | Text, checked October 2026 |
|---|---|---|
| European Union | No transfer under Chapter V; the DPA governs | Article 28 |
| United Kingdom | Adequacy decision, until 27 December 2031 unless extended | Decision (EU) 2021/1772, amended by Decision (EU) 2025/2574 |
| United States, organisation on the Framework list | Adequacy decision, for listed organisations only | Decision (EU) 2023/1795 |
| United States, organisation not on the list | Standard contractual clauses and a documented transfer assessment | Article 46(2)(c); Decision (EU) 2021/914, Clause 14 |
| Canada, recipient subject to the federal law PIPEDA | Adequacy decision adopted under the former directive, kept in force | Decision 2002/2/EC; article 45(9) |
| Another country without an adequacy decision | Standard contractual clauses or another safeguard of article 46 | Article 46 |
Adequacy decisions
A transfer to a country the Commission has found adequate needs no specific authorisation (article 45(1)). The decision on the United Kingdom expires on 27 December 2031 unless extended (Implementing Decision (EU) 2025/2574). The EU-US Data Privacy Framework decision covers only organisations on the list kept by the US Department of Commerce; the General Court dismissed an action against it on 3 September 2025 (case T-553/23). Both decisions are in force on EUR-Lex in October 2026: check them, and your vendor’s listing, at signature.
Standard contractual clauses and the transfer assessment
Otherwise, article 46 requires appropriate safeguards, such as the clauses of Commission Implementing Decision (EU) 2021/914. They come in four modules, one for each pair of roles, and serve importers whose processing is not subject to the GDPR (Article 1). Under Clause 14, the parties assess and document whether the laws and practices of the destination prevent the importer from complying: the market calls it a transfer impact assessment. Where article 3(2) applies to a provider outside the EU, article 27 also requires a representative in the Union.
What do you risk, and what should you negotiate?
Liability and fines are set by law; caps, audits, notice periods and deadlines by the contract, which is where a French client’s draft deserves a careful read.
Liability and fines
Anyone who suffers material or non-material damage from an infringement can claim compensation from the controller or the processor (article 82(1)). A processor is liable only where it breached the obligations specific to processors or acted outside or contrary to lawful instructions (article 82(2)). Where both are responsible, each answers for the entire damage, then claims back the other’s share (article 82(4) and (5)).
Fines reach processors too: up to 10,000,000 euros or, for an undertaking, 2 % of total worldwide annual turnover of the preceding financial year, whichever is higher, for articles 25 to 39 (article 83(4)); up to 20,000,000 euros or 4 % for the transfer rules (article 83(5)).
The French side of the table
Article 8 of the French data protection law n° 78-17 (Informatique et libertés), checked October 2026, makes the CNIL, Commission nationale de l’informatique et des libertés, the national supervisory authority under the GDPR and tasks it with publishing guidelines for controllers and their processors. A French client may send its own DPA in French. The GDPR sets no language: ask for an English version and agree which one prevails. The law and language of the main contract are covered in the guide to doing business in France.
Five points to negotiate
- Liability cap. Under French law, a cap between the parties has limits: a clause that deprives the essential obligation of its substance is deemed unwritten (article 1170 of the French Civil Code, Code civil), and the limit to foreseeable damage falls for gross or wilful misconduct (article 1231-3). No cap binds the data subjects.
- Audits. The Commission’s clauses speak of audits at reasonable intervals or on indications of non-compliance; agree the frequency, the notice and the weight of certifications.
- Sub-processors. The initial list, how changes are announced, the notice period and what happens if the client objects.
- Breach timing. A number of hours you can meet, counted from awareness, with an initial notice completed later, as Clause 9.2 of the Commission’s clauses allows.
- Assistance. What counts as a documented instruction, and how help beyond the service is charged.
Concord reviews the DPA your client sends, drafts yours for your own vendors and prepares the transfer clauses: see data processing agreement and transfers. Where the review shows wider gaps, from the record of processing to an EU representative, a GDPR compliance audit puts them in order. Send us the DPA you were asked to sign.