How to sign a data processing agreement (DPA)

As soon as a tool processes personal data on your behalf, the supplier is your data processor. This applies, for example, to customers in a newsletter tool, employees in a payroll system or clients in a booking system. GDPR Article 28 then requires a written agreement: a data processing agreement, usually called a DPA.

Sounds heavy? In practice it is usually a checkbox.

How it works

1. Find the supplier’s standard DPA. Almost all serious services have one. Search for “DPA”, “Data Processing Agreement” or “personuppgiftsbiträdesavtal” together with the tool’s name. You can also look under Legal or Trust on their site.
2. Approve it. With Brevo and Mailchimp, for example, the DPA is included in the terms or activated in account settings. Swedish tools like Bokio handle it in their user terms. Save a copy.
3. Done. You rarely need to negotiate: the standard agreement is built to satisfy Article 28.

Quick check: what a good DPA contains

• What the supplier may do with the data (only what you instruct).
• Sub-processors listed, with your right to object to changes.
• Security measures, confidentiality and assistance with incidents.
• Deletion or return of data when the agreement ends.
• For transfers outside the EU/EEA: standard contractual clauses (SCC) or another valid basis. This is especially important with American suppliers (read why in our CLOUD Act guide).

Most common mistakes

• No DPA at all with tools that obviously process personal data. This is most common with small and new AI services. If you cannot find a DPA from the supplier, that is a warning sign in itself.
• Free tools for sensitive data. Consumer versions of AI chats often have no processing agreement at all. Personal data should not go there.
• Forgotten sub-processors. An EU tool can send data to American AI models behind the scenes. The sub-processor list reveals that.

Five minutes per tool. Make it a habit for every new account, and that part of the GDPR work is done.