What is a data processing agreement?

It is the written contract between a controller and a processor that sets out how the processor may handle personal data on the controller’s behalf. Article 28(3) of the GDPR lists what it must cover.

When do I need a DPA with an overseas provider?

When the provider processes personal data on your behalf, for example a BPO team handling customer records. Employees of your own business are part of the controller and do not need one.

What must an Article 28(3) contract include?

Processing only on documented instructions, confidentiality of staff, Article 32 security, rules on sub-processors, help with data-subject requests and Articles 32 to 36 duties, deletion or return at the end, and audit rights.

Can my provider use sub-processors?

Only with the controller’s prior specific or general written authorisation. With a general authorisation the processor must notify changes so the controller can object, and it stays fully liable for the sub-processor.

Is a DPA the same as standard contractual clauses?

No. A DPA governs the processor relationship. Standard contractual clauses such as Decision 2021/914 are a transfer mechanism for data leaving the EU or EEA. A contract can include both.

Does the UK need a DPA too?

The UK GDPR has its own Article 28; the ICO’s guidance on sub-processors points to Article 28(4). Check the ICO’s contracts guidance for the UK requirements rather than relying on the EU text.

Data Processing Agreement Explained

A data processing agreement (DPA) is the written contract between a controller, the business that decides why and how personal data is used, and a processor that handles that data on its behalf. Under Article 28(3) of the EU General Data Protection Regulation (GDPR), processing by a processor must be governed by a binding contract or other legal act that sets out the subject-matter, duration, nature and purpose of the processing, the type of personal data, the categories of data subjects and the controller’s obligations and rights. Article 28(9) adds that the contract must be in writing, including in electronic form.

Controller or processor: who needs a DPA

The ICO explains that a controller makes decisions about processing and is ultimately in charge of it, while a processor acts on behalf of the controller and under its authority, serving the controller’s interests rather than its own. A processor can be a company or an individual, for example a consultant. Employees of the controller are not processors; they are part of the controller. A DPA is therefore needed when an outside party handles personal data for you, not for your own staff.

For an overseas hire, the question is who is who. A business process outsourcing arm (BPO) that handles your customer records is a typical processor. An employer of record holds the employment relationship, so the roles for employee data depend on the facts. RemoteStaffingWiki’s judgement is to ask any provider in writing which role it takes for each type of data, and to sign a DPA wherever it acts for you. The ICO states that a party acting outside the controller’s instructions, so that it decides purpose and means, becomes a controller for that processing.

What Article 28(3) says the contract must include

The Regulation states that the contract shall stipulate, in particular, that the processor:

(a) processes the personal data only on documented instructions from the controller, including on transfers to a third country, unless required by Union or Member State law;
(b) ensures that people authorised to process the data are committed to confidentiality or under a statutory duty of confidentiality;
(c) takes all measures required under Article 32 (security of processing);
(d) respects the conditions in paragraphs 2 and 4 for engaging another processor;
(e) assists the controller, by appropriate technical and organisational measures where possible, in responding to data-subject requests;
(f) assists the controller with its obligations under Articles 32 to 36;
(g) at the controller’s choice, deletes or returns all personal data after the services end, and deletes existing copies unless law requires storage;
(h) makes available all information needed to demonstrate compliance and allows for and contributes to audits, including inspections, by the controller or its mandated auditor.

The processor must also immediately inform the controller if, in its opinion, an instruction infringes data protection law.

Sub-processors

Article 28(2) provides that a processor shall not engage another processor without the controller’s prior specific or general written authorisation. Under a general authorisation, the processor must tell the controller of intended additions or replacements so that the controller can object. Article 28(4) requires the same data protection obligations to be imposed on the other processor by contract, and says the initial processor remains fully liable to the controller if the other processor fails. The ICO notes that “sub-processor” is shorthand rather than a term used in the UK GDPR itself.

The UK equivalent

The ICO’s guidance on sub-processors points to Article 28(4) of the UK GDPR, so the rule that a processor’s sub-processors take on the same obligations has a UK counterpart. The UK retained Article 28 with its own text, separate from the EU Regulation, so check the ICO’s contracts guidance for the UK requirements. For a business that employs through an entity abroad, the local entity entry explains when its own contracts and registrations come into play.

Transfers outside the EU and the SCCs

A DPA covers the relationship; it does not by itself legalise a transfer to a country outside the EU. The European Commission explains that contractual clauses pre-approved by the Commission can serve as a ground for transfers to third countries, and that on 4 June 2021 it issued modernised standard contractual clauses (Implementing Decision (EU) 2021/914) for transfers from controllers or processors in the EU/EEA to controllers or processors outside it. Separately, an adequacy decision means data can flow to that country without further safeguards. The Commission notes the UK is covered by adequacy decisions renewed in December 2025, and that the UK has endorsed the EU SCCs through an international data transfer addendum. Article 28(7) lets the Commission lay down standard clauses for the processor-contract matters themselves.

RemoteStaffingWiki checklist before signing

DPA review checklist (RemoteStaffingWiki’s own, not a legal standard)

Check	Why
Roles named for each data type	Controller and processor status follows who decides purpose and means
Article 28(3) points (a) to (h) all present	These are the contract terms the Regulation lists
Sub-processor list and notice period	Article 28(2) and 28(4) authorisation and liability
Transfer mechanism named	Adequacy decision or SCCs where data leaves the EU
Deletion or return on exit	Article 28(3)(g)
Audit and information rights	Article 28(3)(h)

Use alongside the guides on data security when outsourcing and international background checks.

See also the guides to data security when outsourcing and international background checks for remote hires, and the broader entry on GDPR for remote hiring.

Sources

References checked on 1 November 2026

Data Processing Agreement (DPA)

Definition