GDPR Data Processing Agreement Clauses Guide Common Mistakes for Compliance Teams

A data processing agreement (DPA) is not a formality. Under Article 28 of the GDPR, it is the contract that turns a processor's instructions into enforceable duties. When controllers and processors negotiate, small wording choices decide who bears breach costs, whether sub-processors can be added, and whether transfers outside the EEA remain lawful. This GDPR data processing agreement clauses guide common mistakes review highlights the clauses that auditors, supervisory authorities, and procurement teams examine first.

Why Article 28 Turns a DPA Into a Risk Document

Article 28(3) lists mandatory terms. The contract must describe processing subject matter, duration, nature, purpose, data types, and categories of data subjects. It must also impose duties on the processor: process only on documented instructions, ensure confidentiality, implement Article 32 security, assist with data subject rights, notify breaches, support DPIAs, delete or return data, and submit to audits. Article 28(10) says a contract that lacks these terms is not automatically void, but the missing clauses are read into it by law. That does not remove risk. A vague DPA still creates disputes about scope, liability, and evidence. See GDPR Data Processing Agreement Clauses: A Practical Guide for clause-by-clause drafting.

Core Clauses Every DPA Should Cover

Start with processing instructions. The DPA should define what counts as a documented instruction and how updates are issued. If the processor must flag an instruction it believes infringes GDPR, state the escalation path and response time. Next, map security. Article 32 requires appropriate technical and organisational measures, but the DPA should name the measures or reference an annex that does. Then cover personnel confidentiality, training, and access control. Finally, set out breach notification. Article 33 uses a 72-hour controller notification clock, so the processor's deadline to inform the controller must be shorter. A common failure is a DPA that repeats 'without undue delay' without a concrete hour or day limit.

Processor Obligations and Sub-Processors

Article 28(2) requires prior specific or general written authorisation for sub-processors. General authorisation is common, but it must come with a right to object and a duty to inform the controller of changes. The DPA should flow down the same data protection duties to every sub-processor. It should also state whether the processor remains fully liable for sub-processor performance. If the processor uses a cloud provider, payment provider, or support vendor outside the EEA, the transfer clauses need separate attention. Do not bury sub-processor lists in a website that can change without notice. Use a versioned annex and a notice mechanism.

Common Mistakes in GDPR Data Processing Agreement Clauses Guide Common Mistakes

This GDPR data processing agreement clauses guide common mistakes section focuses on errors that repeat across procurement reviews. First, using a controller-to-controller contract when the relationship is controller-to-processor. The labels matter because Article 28 duties apply only to processors. Second, copying a template from another jurisdiction without checking EU GDPR wording. Third, omitting audit rights or limiting them so heavily that the controller cannot verify compliance. Fourth, failing to address deletion and return. Article 28(3)(g) requires deletion or return at the end of service, with a choice for the controller. Fifth, ignoring liability. Article 82 allows data subjects to claim compensation, and the DPA should explain indemnities, caps, and exclusions without conflicting with GDPR rights. Sixth, leaving international transfers to a generic 'we comply with law' sentence. Chapter V requires a valid transfer tool, such as an adequacy decision, Standard Contractual Clauses, or another Article 46 mechanism. Seventh, treating records of processing as optional. Article 30 records and DPA annexes should match. If your organisation also maintains quality or product files, apply the same discipline you would use for an ISO 9001 documentation requirements guide: version control, owners, approval dates, and review cycles.

International Transfers and Clause Mapping

When personal data leaves the EEA, the DPA must connect to a transfer mechanism. The EU Standard Contractual Clauses are modular. Use the correct module: controller-to-processor, processor-to-controller, controller-to-controller, or processor-to-processor. Then complete the annexes with data subjects, purposes, transfers, and security measures. If you rely on an adequacy decision, name it and monitor changes. If you use the EU-U.S. Data Privacy Framework, verify the recipient's active certification. A transfer impact assessment may be needed after Schrems II. The DPA should require the processor to notify the controller if it can no longer meet transfer obligations. For product-facing compliance, keep the DPA and any EU CE Marking Technical File: A Practical Guide records aligned if the same data supports market access or post-market surveillance.

A Practical Review Workflow

Build a DPA review checklist with owners and evidence. Step one: classify the role. Is the party a processor, joint controller, or independent controller? Step two: compare the DPA against Article 28(3)(a)-(h). Step three: check sub-processor authorisation and flow-down. Step four: test breach timelines against Article 33. Step five: verify transfer tools and annexes. Step six: confirm deletion, audit, and liability terms. Step seven: log the approved version and review date. Use a red-flag list for missing clauses, unlimited sub-processor changes, vague security, and audit refusal. Train procurement and sales teams to route DPAs to privacy counsel before signature. A DPA that is signed late or amended by email is harder to defend. This GDPR data processing agreement clauses guide common mistakes approach keeps the contract, the Article 30 record, and the actual processing aligned.