Data Processing Agreements Under GDPR: What You Need to Know in 2026

When a DPA is required

Under Article 28 of the GDPR, a Data Processing Agreement is required whenever a controller engages a processor. In practice: every SaaS vendor, cloud host, email provider, and analytics tool that handles EU personal data on your behalf needs a DPA.

The 9 required elements

Article 28(3) specifies: processing only on documented instructions, confidentiality obligations, appropriate security, sub-processor controls, assistance with data subject rights, breach notification assistance, deletion/return on termination, audit rights, and obligation to inform controller of GDPR-infringing instructions.

Missing even one element means the DPA is non-compliant.

Sub-processor rules

Your vendor almost certainly uses sub-processors — AWS for hosting, Stripe for payments, Twilio for SMS. Under GDPR, the processor must: get prior written consent, maintain a current list, notify you before adding new ones (30 days is standard), give you an objection right, and ensure equivalent obligations.

Cross-border transfers

If your vendor transfers data outside the EEA, the DPA must address this with appropriate safeguards — typically Standard Contractual Clauses (SCCs). The EU-US Data Privacy Framework provides adequacy for certified US companies, but not all vendors are certified.

Breach notification timelines

GDPR requires controllers to notify authorities within 72 hours. Your DPA should require the processor to notify you within 48 hours — giving you time to assess and report.

The notification should include: nature and scope, categories of data affected, estimated number of data subjects, likely consequences, and remedial measures.