Data Processing Agreement (DPA) Template — Article 28 Compliant

When Do You Need a DPA?

Under Article 28(3), any processing by a data processor on behalf of a data controller must be governed by a contract (Data Processing Agreement, DPA). For non-EU businesses, DPAs are needed with: your hosting provider (AWS, DigitalOcean, Hetzner), email marketing platform (Mailchimp, ConvertKit), payment processor (Stripe, PayPal, Paddle), analytics provider (Google Analytics, Mixpanel), CRM platform (Salesforce, HubSpot), and any other third party that processes EU personal data on your instructions.

What a Valid DPA Must Include (Article 28(3))

• Subject matter and duration of processing
• Nature and purpose of processing
• Type of personal data and categories of data subjects
• Controller’s obligations and rights
• Processor processes data only on documented instructions
• Confidentiality obligations for personnel authorized to process data
• Security measures per Article 32
• Sub-processor conditions (notification + authorization)
• Data subject rights assistance
• Breach notification assistance
• Data deletion or return upon contract termination
• Audit rights for the controller
• Processor’s EU Representative details (if the processor is non-EU)

Cross-Border Transfers (SCCs)

If your data processor is non-EU, the DPA must include Standard Contractual Clauses (SCCs) for cross-border transfers. The EU’s 2021 SCCs are the current standard. Include the SCCs as an annex to your DPA. Data transfers guide →

EU Representative Clause

Article 28(3)(h) requires the processor to assist the controller in ensuring compliance with Articles 32-36. If the processor is non-EU, they must have their own EU Representative under Article 27. Include a clause requiring the processor to maintain an EU Representative and provide their contact details.

Get your EU Rep → · Other templates →