GDPR Data Processing Agreement Clauses Requirements for Small Business: Practical Guide

Small businesses often sign a data processing agreement (DPA) because a client sends one over. That is backwards. Under GDPR Article 28, the DPA is the legal instrument that makes a processor relationship lawful and auditable. This guide explains the GDPR data processing agreement clauses requirements for small business in plain language, with clause references you can use in negotiations.

Why Article 28 Matters for Small Businesses

GDPR Article 28(3) says processing by a processor must be governed by a contract or other legal act under Union or Member State law. The contract must be binding on the processor and set out the subject-matter, duration, nature and purpose of processing, the type of personal data, categories of data subjects, and the obligations and rights of the controller. For a small business, that means you cannot rely on a one-page vendor term or a privacy policy alone. You need a written or electronic agreement that covers the required points.

GDPR distinguishes between a controller, who decides why and how personal data is processed, and a processor, who acts on the controller's behalf. A small business can be either. If you run payroll software for clients, you are likely a processor. If you use a marketing tool to contact your own customers, you are likely a controller. The DPA must match your role. A controller-to-processor DPA is not the same as a processor-to-sub-processor agreement.

The European Data Protection Board (EDPB) has clarified that the controller remains responsible for compliance, even when a processor handles the data. A DPA does not transfer your accountability. It allocates operational duties and creates evidence. If you are a processor for a larger client, you will also be asked to sign a DPA. In that case, your own vendor contracts must line up with the promises you make upstream. See GDPR Data Processing Agreement Clauses: A Practical Guide for a deeper clause-by-clause walkthrough.

The Core Clauses Under GDPR Article 28(3)

Article 28(3) lists the minimum clauses. The processor must:

• process only on documented instructions from the controller, including for transfers outside the EU/EEA, unless required by law;
• ensure people authorised to process personal data are committed to confidentiality;
• take all measures required by Article 32 (security of processing);
• respect the conditions for engaging another processor (Article 28(2) and 28(4));
• assist the controller with data subject rights requests under Chapter III;
• assist the controller with Article 32 security, Article 33 breach notification, Article 34 communication to data subjects, and data protection impact assessments under Article 35;
• delete or return personal data at the end of the provision of services, unless Union or Member State law requires storage;
• make available all information necessary to demonstrate compliance and allow for audits, including inspections, by the controller or an auditor mandated by the controller.

These are not suggestions. If a clause is missing, the DPA is incomplete. The GDPR data processing agreement clauses requirements for small business are not optional paperwork; they are the evidence you need if a supervisory authority asks how you protect personal data.

Documented instructions are the backbone of the DPA. If you tell a processor to use data for a new purpose without updating the agreement, you may create an unlawful processing activity. Keep instructions in writing, and make sure the DPA says the processor must inform you if an instruction infringes GDPR or other Union or Member State data protection law.

Practical drafting notes for lean teams

Small teams can keep the DPA manageable by using a modular schedule. Put the core Article 28(3) terms in the main body. Add annexes for categories of data, processing purposes, security measures, sub-processors, and transfer safeguards. That structure makes updates easier when you change vendors or add a new tool. It also helps you show accountability under Article 5(2). If you already maintain a quality management system, borrow the discipline from The ISO 9001 documentation requirements guide: A Practical O for version control and approval records.

Sub-Processors, International Transfers, and Security

Article 28(2) requires prior specific or general written authorisation for sub-processors. If you use general authorisation, the processor must inform you of intended changes and give you the chance to object. The same data protection obligations must flow down to the sub-processor under Article 28(4). For international transfers, the DPA should identify the transfer mechanism: an adequacy decision, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or a derogation under Article 49.

The DPA should also state the security measures required by Article 32, such as encryption, access control, pseudonymisation, and resilience testing. Small businesses should not copy a generic security annex. Describe the actual controls you and your processor use. If you sell into the EU and also handle product compliance, the documentation habits in EU CE Marking Technical File: A Practical Guide are a useful model for keeping technical evidence current.

Transfer risk is a frequent problem for small businesses. If your processor stores data in a third country, the DPA must include the right transfer tool. An adequacy decision is the simplest route. Where no adequacy decision exists, SCCs are common. You may also need a transfer impact assessment. Record the assessment and review it when laws or vendors change.

If you are a small business acting as a processor, check that your sub-processor list is accurate. A stale list is a common audit finding. Name the sub-processors, their locations, and the processing they perform. If a sub-processor changes, follow the notice and objection process in the DPA.

Breach Support, Audits, and Liability

Article 33 requires controllers to notify the supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk. The processor must assist without undue delay. The DPA should set a clear notification timeline, a contact point, and the information the processor must provide. Many small businesses use an internal 24-hour deadline so they can assess the breach and meet the 72-hour clock.

Article 28(3)(h) gives the controller audit and inspection rights. For small businesses, a full on-site audit may be impractical, so use a risk-based approach: annual questionnaires, security certifications, penetration test summaries, and remote reviews. Audit rights should be practical. A clause that promises unlimited audits but no process is hard to use. Define notice periods, scope, confidentiality, and cost allocation. If you rely on a processor's certification, check the scope and expiry date. Certifications can support your Article 28(3)(h) evidence, but they do not replace the DPA.

Liability matters too. Article 82 allows data subjects to claim compensation. Article 83 allows fines up to €20 million or 4% of annual global turnover, whichever is higher. The DPA should allocate responsibility between controller and processor without limiting data subject rights.

A Small-Business DPA Checklist

Before you sign or renew, check:

• Is the agreement in writing or electronic form?
• Does it state subject-matter, duration, nature, purpose, data types, and data subject categories?
• Does it include every Article 28(3) obligation?
• Does it cover sub-processor authorisation and flow-down?
• Does it identify transfer mechanisms and safeguards?
• Does it set breach notification timelines and support duties?
• Does it grant audit and inspection rights?
• Does it explain deletion or return of data at the end of services?
• Does it include liability and indemnity terms that match your risk?

Use this checklist to map the GDPR data processing agreement clauses requirements for small business to your own contracts. If a vendor refuses a required clause, document the risk and consider a different vendor. The DPA is not a formality; it is the operating manual for lawful processing. Keep signed copies, review them annually, and update annexes when your tools or vendors change.

Store the DPA with your Article 30 records of processing activities. If you do not keep Article 30 records, start a simple register now. It should list your processors, the data categories, the purpose, and the transfer mechanism. This register makes annual reviews faster and helps you respond to data subject requests.