Data processing agreement (DPA)
This sample agreement governs the processing of personal data on behalf of a controller pursuant to Art. 28 GDPR — relevant as soon as we process personal data for clients (e.g. operating a website with a contact form).
Sample content of the demo website — not legal advice. Have it reviewed by a lawyer and complete the annexes (TOMs, subprocessor list) before real-world use.
1. Subject matter and duration
The processor (Formwerk Architekten & Ingenieure GmbH, Musterstraße 12, 10115 Berlin) processes personal data exclusively on behalf of and according to the instructions of the controller. Subject, nature and purpose of processing, data categories and data subjects are specified in Annex 1 to the main contract. The agreement applies for the term of the main contract.
2. Right to issue instructions
Processing takes place only on documented instructions of the controller. If the processor considers an instruction to violate data protection law, it informs the controller without delay and may suspend execution until clarification.
3. Technical and organisational measures
The processor implements appropriate technical and organisational measures pursuant to Art. 32 GDPR (including encryption, access control, EU hosting, logging). The measures are documented in Annex 2 and kept in line with the state of the art.
4. Subprocessing
Engaging subprocessors requires the controller's prior written approval. Engaged subprocessors (Annex 3) are bound to the same level of data protection; all services used process data exclusively within the EU.
5. Assistance to the controller
The processor assists the controller in responding to data subject requests (Art. 12–23 GDPR) and with data protection impact assessments, and reports personal data breaches without undue delay, at the latest within 48 hours of becoming aware.
6. Deletion and return
Upon completion of the services, all personal data is, at the controller's choice, returned or deleted in a privacy-compliant manner, unless statutory retention obligations require otherwise. Deletion is confirmed in writing upon request.