Learn what a GDPR data processing agreement requires under Article 28, how to audit SaaS vendors, avoid fines, and manage international data transfers.
Yes, you need a signed gdpr data processing agreement whenever a SaaS tool handles personal data for your business. Without Article 28 terms covering sub-processors and breach alerts, your business faces regulatory penalties up to €10 million.
What a processing agreement is and who needs it
Under Article 28(3) of the General Data Protection Regulation, any European Union or UK company sharing personal data with an external software vendor must execute a written gdpr data processing agreement. This contract defines how personal data is handled, stored, and protected during the commercial relationship.
This requirement is essential for any company using third-party software tools to conduct business. If your team relies on external email platforms, web analytics, sales CRMs, or cloud storage providers that store customer or staff records, you act as a data controller. Because these tools process data on your behalf, a legally binding contract must be executed before data transfer begins.
However, this contract requirement does not apply to every external partner. You do not need a processing agreement when working with independent third-party controllers who determine their own processing purposes. For example, postal services and freight couriers operate under their own legal duties. Similarly, purely internal administrative tasks that do not involve third-party software fall outside this scope.
Failing to execute a required agreement carries severe legal consequences. Under Article 83(4), supervisory authorities can issue statutory fines up to €10 million or 2% of your global annual turnover, whichever is higher, for processor-related contracting failures.
Controllers, processors and the factual control doctrine
Understanding your legal role under European privacy law is necessary before signing software contracts. Article 4(7) defines a data controller as the entity that determines the purposes and means of processing personal data. Article 4(8) defines a data processor as the external entity processing data on behalf of the controller.
The factual control doctrine explained
Contractual labels alone do not shield your business from legal liability. Regulatory bodies apply the factual control doctrine when evaluating compliance. If operational reality contradicts your contract terms, authorities disregard the contract text.
For instance, if a software vendor decides independently how to use your customer records, regulators will classify that vendor as a controller. According to Dutch Data Protection Authority guidelines, updated in December 2025, supervisory authorities always prioritize practical operational control over written labels. If you decide why and how personal data is collected, you bear the regulatory obligations of a controller regardless of what your agreement states.
Logistics exceptions and joint exposure
Certain third-party service providers fall outside the processor classification. Logistics and courier services act as independent controllers rather than processors. Because track-and-trace details are handled under the courier's own legal and operational rules, businesses do not need to execute DPAs with parcel delivery companies.
Outside of specific statutory exceptions, operating without a contract creates severe exposure. If a business transmits personal data to a SaaS vendor without an executed agreement, both the controller and processor face joint regulatory liability. Supervisory authorities can penalize both parties as soon as processing begins.
Mandatory clauses required under Article 28
Article 28(3) sets out eight mandatory statutory clauses that every data processing contract must include. Omitting any of these clauses leaves your agreement non-compliant during a regulatory audit.
The eight mandatory Article 28 terms
- Documented instructions: The processor must process personal data only on documented written instructions from the controller.
- Confidentiality commitments: Every person authorized to process personal data must commit to confidentiality or be under an appropriate statutory obligation.
- Technical security: The processor must implement technical and organizational security measures pursuant to Article 32.
- Sub-processor authorizations: The vendor cannot engage sub-processors without prior specific or general written authorization from the controller.
- Data subject rights: The vendor must assist the controller through technical measures to fulfill data subject access or erasure requests.
- Breach and DPIA support: The processor must assist the controller with breach notifications and Data Protection Impact Assessments under Articles 35 and 36.
- Post-termination deletion: The processor must delete or return all personal data to the controller after services end.
- Audit cooperation: The vendor must make compliance information available and allow for audits conducted by the controller.
Sub-processors and data deletion terms
Sub-processor governance requires strict oversight under Article 28(4). Vendors must notify controllers of any planned changes to sub-processors, giving controllers time to object. Furthermore, processors must pass identical data protection obligations down to downstream infrastructure vendors.
Data retention terms must define clear timelines for data removal. Standard contract templates, such as the Proton-adapted GDPR.eu agreement, enforce a mandatory 10-business-day window for deleting or returning customer data following contract termination. Vendors must also delete existing backup copies unless European Union or Member State law requires retention.
Modern SaaS contracts must address artificial intelligence risks. Buyers must ensure that agreements explicitly prohibit vendors from ingesting customer personal data into machine learning datasets or AI model training pipelines.
Managing data breach notifications within 72 hours
Managing security incidents across vendor supply chains requires precise contract language. A common operational failure occurs due to mismatched statutory deadlines between controllers and processors.
Under Article 33(1), controllers face a strict 72-hour deadline to report personal data breaches to regulatory bodies like France's CNIL or Germany's BfDI. The countdown begins as soon as the controller becomes aware of the incident. However, Article 33(2) states that processors must notify controllers "without undue delay."
Closing the reporting gap
Generic "without undue delay" language creates operational risk. If a software vendor takes 48 hours to inform your security team of a database breach, you are left with 24 hours to investigate and submit reports to regulatory authorities. To mitigate this risk, buyers should negotiate specific timelines, requiring processors to report security incidents within 24 to 48 hours of discovery.
A compliant notification clause must require the processor to provide actionable forensic details. The vendor must supply description of the breach, categories of affected records, estimated numbers of impacted data subjects, and immediate mitigation measures. This information allows controllers to comply with regulatory reporting rules without missing statutory cutoffs.
International data transfers and standard contractual clauses
Exporting personal data outside the European Economic Area introduces additional regulatory requirements under Chapter V of the GDPR. SaaS vendors hosted on foreign cloud servers must provide valid transfer mechanisms.
When working with vendors in the United States or other non-EEA jurisdictions lacking an adequacy decision, businesses rely on European Commission Standard Contractual Clauses. Deploying Commission Decision 2021/914 module clauses ensures that cross-border data flows comply with European privacy protections.
Oversight must extend beyond the primary SaaS vendor. Companies must audit sub-processor jurisdictions across the entire software supply chain. If an EU-based software vendor relies on US cloud infrastructure or offshore support teams, those secondary processing locations must be backed by valid transfer instruments.
How real SaaS vendors implement Article 28
SaaS vendors meet Article 28 requirements through different legal and technical architectures depending on their hosting choices and corporate structure.
Surfer SEO is engineered in Wroclaw, Poland, operating directly under EU jurisdiction. The vendor processes NLP search analysis and customer data within cloud infrastructure located in Poland and Germany. They provide a standard European DPA, with plans starting at US$79 per month when billed annually.
Semrush operates as a US entity incorporated in Delaware. To handle cross-border data transfers for European customers, Semrush incorporates Decision 2021/914 Standard Contractual Clauses into its core data processing agreement, which is governed under Czech law. Pricing for Semrush starts at US$117.33 per month billed yearly.
DataForSEO operates out of Estonia using a pay-as-you-go API infrastructure model. Its sub-processor network includes Hetzner Online GmbH in Germany alongside US cloud platforms. DataForSEO executes written Article 28 sub-processor agreements across its supply chain, accessible with a US$50 minimum balance.
| SaaS Vendor | HQ Location | Data Storage Location | Transfer Mechanism | Starting Price |
|---|---|---|---|---|
| Surfer SEO | Poland (EU) | Poland & Germany (EU) | Direct EU DPA | US$79 / month |
| Semrush | United States | United States | Decision 2021/914 SCCs | US$117.33 / month |
| DataForSEO | Estonia (EU) | Germany (EU) & USA | Article 28 Sub-processor DPAs | US$50 top-up |
Source: vendor legal DPA pages and official pricing tables, checked October 2026.
Bottom line for software buyers
Never rely on generic website terms when sharing personal data with third-party tools. Demand a countersigned Article 28 agreement before onboarding any new software service.
If your team requires localized European cloud infrastructure, Surfer SEO offers direct EU compliance. If you need international marketing tools governed by European framework agreements, Semrush provides integrated Standard Contractual Clauses. For developer API integration, DataForSEO maintains verified sub-processor coverage.
Your immediate next step is to conduct an audit of your current software stack. Verify that every vendor provides written instructions, 24-to-48-hour breach notification rules, 10-day data deletion clauses, and valid international transfer mechanisms.
