Guide · GDPR Art. 28

As of 4 October 2026

Data Processing Agreements (DPA) under Art. 28 GDPR

As soon as a service provider processes personal data on your behalf – cloud, newsletter, payroll or an AI tool – you need a data processing agreement. Here you will find every mandatory element of Art. 28(3) GDPR as a table, a review list for DPAs with AI vendors and an interactive checklist that turns missing items straight into a request to the vendor.

Start the DPA checklist See the mandatory contents

Every mandatory element of Art. 28(3)
Review list for AI vendors
Checklist with request text
DPA and AVV: the same contract

app.simpleact.de

Processors

Demo Organisation Ltd · Contract overview

Providers with data access

Cloud hostingWebsite operationDPA current
PayrollSalary processingDPA current
AI assistant (LLM)Support repliesCheck training
Newsletter toolEmail marketingDPA missing

Sub-processors of the AI assistant

Data centre (EU)
Model API (third country)
Monitoring service

Example data · 1 contract missing, 1 under review

In short

A DPA is the contract under Art. 28 GDPR between you as controller and a service provider that processes personal data only on your behalf and on your instructions. DPA and the German term AVV refer to the same contract. It must be in writing, which includes electronic form, and contain the mandatory elements of Art. 28(3).

Basics

What processing on behalf means – and when you need a DPA

Processing on behalf takes place when an external service provider processes personal data on behalf of a controller (Art. 4(8) GDPR). The controller determines the purposes and means of processing (Art. 4(7)); the processor carries it out – bound by instructions and without purposes of its own. Typical examples are hosting and cloud providers, newsletter and CRM tools, external payroll, IT support with system access, ticketing and chat software and, increasingly, AI services that process texts, documents or conversations.

For this setup Art. 28 GDPR requires two things. First, you may only use processors that provide sufficient guarantees for appropriate technical and organisational measures (para. 1). So you have to check the provider beforehand, not only once something has happened. Second, there must be a contract or other legal act with defined minimum content (para. 3), which must be in writing – electronic form is sufficient (para. 9). That is the data processing agreement, or DPA.

In German the same contract is called an Auftragsverarbeitungsvertrag (AVV); some vendors call it a data processing addendum. There is no difference in substance: what matters is that every mandatory element of Art. 28(3) is covered. Large vendors usually provide their DPA as a standard document that applies with the terms of service or is accepted online. That is permissible – but you should check that it fits how you actually use the service.

Not every collaboration is processing on behalf. If a provider pursues its own purposes or decides itself how and why data is processed, it is a controller in its own right – for example tax advisers and lawyers acting in their professional capacity, banks processing payments or parcel services. If two parties jointly determine purposes and means, they are joint controllers under Art. 26 GDPR and need an arrangement on their respective responsibilities instead of a DPA. The table further down helps you tell them apart.

The distinction matters most with AI vendors. An AI service that processes your inputs only to deliver a result to you can be a processor. But if the vendor also uses the same data for its own purposes – such as training its models – it is no longer acting solely on your instructions in that respect. A processor that infringes the GDPR by determining the purposes and means of processing is considered a controller for that processing (Art. 28(10)). That is why the question of training and data use belongs in every DPA review with AI vendors.

If a DPA is missing or does not cover the mandatory content, both controller and processor infringe Art. 28 GDPR. For this, Art. 83(4)(a) sets fines of up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher. Under Art. 82(2), the processor is liable for damage only where it has not complied with obligations specifically directed to processors or has acted outside or contrary to lawful instructions – responsibility for the processing basically stays with you.

mandatory duties in Art. 28(3)(a)–(h): 8; mandatory duties in Art. 28(3)(a)–(h)
or 2% of turnover: maximum fine for breaches of Art. 28 (Art. 83(4)): €10m; or 2% of turnover: maximum fine for breaches of Art. 28 (Art. 83(4))
contract – DPA and AVV are the same: 1; contract – DPA and AVV are the same

Mandatory contents

What goes into a DPA: every mandatory element under Art. 28 GDPR

Art. 28(3) first lists the key facts of the processing (first sentence) and then eight duties of the processor (points (a) to (h)). Rules from paras. 2, 4 and 9 come on top. The right-hand column shows what to check additionally with AI vendors – that is our recommendation, not an additional legal requirement.

Scroll the table sideways →

What goes into a DPA: every mandatory element under Art. 28 GDPR
Mandatory element	Reference	What should be set out	Check with AI vendors
Subject matter and duration	Art. 28(3), 1st sentence	Which service, from when, for how long (e.g. term of the main contract).	Which functions exactly: chat, API, document analysis, transcription?
Nature and purpose of processing	Art. 28(3), 1st sentence	What happens to the data and why – as specific as possible, not "IT services".	Purpose limited to providing the service? No training of the vendor's own models without your consent?
Type of personal data	Art. 28(3), 1st sentence	Data categories, e.g. contact, contract and usage data; special categories named explicitly.	Are prompts, uploaded files, outputs and logs covered too?
Categories of data subjects	Art. 28(3), 1st sentence	Whose data: employees, customers, prospects, applicants.	Also third parties who appear in documents or conversations?
Obligations and rights of the controller	Art. 28(3), 1st sentence	Right to instruct, audit rights, information duties.	How are instructions implemented technically (settings, admin console)?
Processing only on documented instructions – including transfers to third countries	point (a)	Binding instructions, form of instructions, exception only for legal obligations with prior notice.	Is data transferred to third countries, e.g. to model APIs outside the EU?
Confidentiality of authorised persons	point (b)	Staff committed to confidentiality or under a statutory obligation of confidentiality.	Does this also apply to human review of inputs (e.g. abuse monitoring)?
Security measures under Art. 32	point (c)	Technical and organisational measures (TOMs), usually as an annex.	Encryption, tenant separation, access to prompt logs, log retention.
Conditions for sub-processors	point (d), paras. 2 and 4	Prior specific or general written authorisation; with general authorisation, information about changes and the chance to object; same obligations passed on.	List of sub-processors including model and data centre providers, location, notification channel.
Assistance with data subject rights	point (e)	Help with access, rectification, erasure etc. through appropriate measures.	Can data about a person be found, exported and deleted in histories?
Assistance with Art. 32 to 36	point (f)	Security, breach notification, data protection impact assessment, prior consultation.	Does the vendor provide information for your DPIA? Does it report incidents without undue delay (Art. 33(2))?
Deletion or return at the end of the contract	point (g)	At the controller's choice delete or return, delete copies – unless storage is required by law.	What happens to histories, logs, files and backups? Concrete periods named?
Evidence and audits	point (h)	Provide all information needed to demonstrate compliance, allow audits and inspections.	What evidence exists (audit reports, certificates) and how does an audit work in practice?
Notice of unlawful instructions	Art. 28(3), 2nd subpara.	The processor informs immediately if it believes an instruction infringes data protection law.	–
Written form	para. 9	In writing, electronic form is sufficient (e.g. online acceptance, signed PDF).	Record the version and date of the accepted DPA.

The Commission's standard contractual clauses for Art. 28 (Implementing Decision (EU) 2021/915) may be used in whole or in part as the DPA (Art. 28(6) and (7)). They do not replace the standard contractual clauses for transfers to third countries (Implementing Decision (EU) 2021/914).

Delimitation

Processor, independent controller or joint controller?

Whether you need a DPA depends on who determines purposes and means. The examples are typical classifications – what counts is always how things are actually set up in the individual case.

Scroll the table sideways →

Processor, independent controller or joint controller?
Setup	Who determines purposes and means?	What you need	Typical examples
Processing on behalf	You alone; the provider acts on instructions (Art. 4(8)).	DPA under Art. 28 GDPR	Hosting, cloud storage, newsletter tool, CRM, external payroll, IT support with system access, AI service without its own use of the data
Independent controller	The recipient pursues its own purposes or decides itself (Art. 4(7)).	Legal basis for the transfer, information to data subjects; no DPA	Tax and legal advice, banks and payment services, insurers, parcel services
Joint controllers	Two or more parties jointly determine purposes and means (Art. 26).	Arrangement under Art. 26 with a transparent split of responsibilities	Joint marketing campaigns, jointly operated platforms, group functions under joint control
Mixed case	Partly on instructions, partly for its own purposes.	DPA for the part on behalf, a separate assessment for its own purposes	AI vendor that also uses inputs for training; software vendor with its own product analytics

Rule of thumb: whoever has an interest of its own in the data and decides about it is not merely a processor. The mere possibility of seeing data, on the other hand, does not turn a provider into a controller.

AI vendors

DPAs with AI vendors: 8 points to check on top

AI services often process more data than is visible at first glance: inputs, uploaded files, outputs, histories and technical logs. These points are our review recommendation for DPAs with vendors of language models, chatbots, transcription and analytics tools.

Training on your data

Clarify in writing whether inputs, files or outputs are used to train or improve the models. For processing on behalf this should be excluded or happen only on your explicit instruction. Watch out for differences between consumer and business versions.

“Please confirm that our inputs, files and outputs are not used to train or improve your models.”

Prompt and output logs

Many vendors keep logs for abuse detection or troubleshooting. Ask what is stored, for how long, who has access and whether you can limit storage.

“Please tell us which logs of inputs and outputs you store, for how long and who has access to them.”

Human review of content

Are inputs reviewed by people on a sample basis, for example for abuse monitoring? Then the confidentiality duty (point (b)) must apply to those people too – and you should know where they are located.

“Please tell us whether and under which conditions staff or service providers can view content from our use.”

Model and data centre providers

Behind an AI tool there is often a model vendor and a cloud data centre. Both are usually sub-processors and belong on the list under paras. 2 and 4 – with location and role.

“Please send us your current list of sub-processors, including model and data centre providers and their locations.”

Third-country transfers

If processing takes place wholly or partly outside the EEA, a basis under Chapter V GDPR is needed, such as an adequacy decision or standard contractual clauses. Also ask about remote access from third countries, e.g. for support.

“Please tell us to which third countries data is transferred or from where it is accessed, and on which basis under Chapter V GDPR.”

Deletion of histories and files

Ask for deletion periods for histories, uploads, logs and backups – during operation and after the contract ends (point (g)). "Will be deleted" without a period is not a robust contractual term.

“Please state the deletion periods for histories, uploaded files, logs and backups during the term and after the contract ends.”

Information for the DPIA and the AI Act

For a data protection impact assessment you need information about the system. Deployers of high-risk AI are to use the provider's information under Art. 13 AI Act for their DPIA (Art. 26(9) AI Act). Make sure the vendor supplies this information (point (f)).

“Please provide the information we need for a data protection impact assessment (how it works, data flows, security measures).”

Settings as instructions

With AI tools many instructions are implemented through admin settings: history off, EU data region, short retention. Document these settings – they are part of your documented instructions (point (a)).

“Please confirm which configuration options (e.g. data region, history, retention) are available and effective under our contract.”

The AI Act does not change Art. 28 GDPR. It applies in addition for high-risk AI, whose deployer obligations apply from 2 December 2027 after the Digital Omnibus.

Interactive

DPA checklist: review the contract, request what is missing

Put your provider's DPA next to you and go through the points. On the right you see what is missing – and a ready-made text to request the missing points from the vendor. No data is stored or transmitted.

Provider (optional)

Key facts (Art. 28(3), 1st sentence, para. 9)

Subject matter, duration, nature and purpose
Described specifically, not just "IT services". Art. 28(3), 1st sentence
Types of data and data subjects
Data categories and groups of people named. Art. 28(3), 1st sentence
Documented in writing or electronically
Signed, accepted online, version and date known. Art. 28(9)

Duties of the processor (points (a)–(h))

Bound by instructions incl. third countries
Processing only on documented instructions. point (a)
Confidentiality of staff
Commitment or statutory obligation. point (b)
TOMs under Art. 32 as an annex
Concrete measures, not just a reference. point (c)
Sub-processors governed
Authorisation, list, information about changes, objection. point (d), paras. 2, 4
Assistance with data subject rights
Access, erasure, rectification. point (e)
Assistance with Art. 32–36
Breaches, DPIA, consultation. point (f)
Deletion or return at the end
Controller's choice, copies deleted. point (g)
Evidence and audits
Information, audits, inspections. point (h)

Extra points for AI vendors (recommendation)

No training on your data
Explicitly excluded or only on instruction. Art. 28(3)(a), (10)
Logs and deletion periods named
Prompts, outputs, uploads, backups. points (c), (g)
Third-country basis named
Adequacy decision or standard contractual clauses. Chapter V GDPR

app.simpleact.de

Result

0 of 14 points assessed

Assess all points to see a complete result.

A working aid for orientation, not legal advice. Whether a contract is sufficient depends on the specific processing.

Approach

DPA management in 6 steps

This is how you bring order to your processors – from the first overview to ongoing maintenance. The order is a recommendation from practice.

1
List your providers
Go through the supplier list, licence management and records of processing. Every provider with access to personal data is a candidate – including remote maintenance, IT support and AI tools that business units booked themselves.
2
Classify the role
Processor, independent controller or joint controller? The delimitation table above helps. You only need a DPA for processors.
3
Check the vendor upfront
Art. 28(1) requires sufficient guarantees. Check TOMs, sub-processors, locations and evidence before data flows – not afterwards.
4
Conclude or review the DPA
Use the vendor's DPA or your own template. Go through the checklist on this page and request missing points in writing.
5
Link it to the records of processing
Enter processors as recipients in the records of processing activities (Art. 30(1)(d)) and refer to the contract. For AI tools, also refer to the entry in the AI register.
6
Track changes
New sub-processors, changed DPA versions, new features: decide who reads and assesses vendor notifications. An annual review of all contracts is good practice.

Third countries

Processors outside the EU

If a processor or one of its sub-processors is located outside the European Economic Area or accesses data from there, the DPA alone is not enough. The transfer also needs a basis under Chapter V GDPR (Art. 44 et seq.).

The main bases are Commission adequacy decisions (Art. 45) and standard contractual clauses (Art. 46(2)(c), currently Implementing Decision (EU) 2021/914). For the United States, the Commission adopted an adequacy decision on the EU-US Data Privacy Framework on 10 July 2023 (Implementing Decision (EU) 2023/1795). It only covers companies certified under the framework.

Ask for the location of every sub-processor, including for support and remote access
Document the basis for each transfer: adequacy decision, standard contractual clauses or another safeguard
For US vendors, check whether a current certification under the Data Privacy Framework exists
With standard contractual clauses, document the assessment of the legal situation in the third country

More on bases and assessment on our page about third-country transfers.

Common mistakes

Where DPAs fail in practice

A DPA for every provider

Tax advisers, banks or lawyers acting in their professional capacity are usually controllers in their own right. A DPA with them describes the role incorrectly and hides the assessment of the transfer that is actually needed.

Purpose: "IT services"

A DPA that describes nature and purpose only in general terms barely meets the first sentence of Art. 28(3). Describe specifically what the provider does with which data.

TOMs as a mere reference

"The vendor takes appropriate measures" is not a description of TOMs. Ask for the measures as an annex or in a current document.

Sub-processors ignored

With a general authorisation you must be informed about changes and be able to object. Whoever does not read the notifications loses this right in practice.

Consumer accounts at work

Many AI tools only offer a DPA on business or enterprise plans. If staff use private or free accounts, there is often no DPA – and inputs may be used for training.

Accepted but not filed

DPAs accepted online change. Keep the version and date of the accepted version, otherwise you cannot later prove what was agreed.

With SimpleAct

Manage processors in one place

In SimpleAct's GDPR module (from Professional) you manage processors, contracts and TOM evidence centrally – linked to the records of processing and TOMs.

DPA and evidence per provider
Next review date per provider
Linked to records of processing and TOMs
Overdue reviews flagged

Looking for SimpleAct's own DPA?

You will find our own data processing agreement for customers under Legal.

View SimpleAct's DPA

FAQ

Frequently asked questions about data processing agreements

None in substance. DPA (data processing agreement) is the English term, AVV (Auftragsverarbeitungsvertrag) the German one. Both refer to the contract under Art. 28 GDPR. You do not need both, but one contract that covers every mandatory element of Art. 28(3).

Whenever an external provider processes personal data on your behalf and on your instructions – for example hosting, newsletter and CRM tools, external payroll, IT support with system access or AI services. If the provider pursues its own purposes, it is a controller in its own right and no DPA is needed.

Under Art. 28(3) GDPR: subject matter and duration, nature and purpose of processing, type of data, categories of data subjects, the controller's obligations and rights, and eight duties of the processor – acting on instructions, confidentiality, security measures under Art. 32, rules for sub-processors, assistance with data subject rights and with Art. 32 to 36, deletion or return at the end of the contract, and evidence and audits.

It must be in writing, and electronic form is sufficient (Art. 28(9) GDPR). In practice a DPA accepted electronically or a PDF with an electronic signature is often enough. Record the version and date.

If staff enter personal data into an AI tool and the vendor processes it on your behalf, yes. Many vendors only provide a DPA on business or enterprise plans. Also check whether inputs are used for training, which logs are stored and whether data goes to third countries.

It can be a processor for providing the service. But if it uses data for its own purposes such as training its models, it is no longer acting only on your instructions in that respect. A processor that infringes the GDPR by determining purposes and means is considered a controller for that processing (Art. 28(10)). So address training explicitly.

Further providers your processor engages, such as data centres or model vendors. They may only be engaged with your prior specific or general written authorisation. With a general authorisation, the processor must inform you about changes so that you can object (Art. 28(2)). The same data protection obligations must be imposed on them (para. 4).

Often yes, if it covers every mandatory element of Art. 28(3) and fits how you actually use the service. Check the purpose description, sub-processors, third-country transfers, deletion periods and, for AI tools, use for training in particular. The checklist on this page helps.

Then a requirement for processing on behalf under Art. 28 GDPR is missing. Infringements of the obligations in Art. 28 can be fined under Art. 83(4)(a) up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher. Conclude the contract and check whether data has already been shared.

Basically, the controller remains responsible. Under Art. 82(2) GDPR the processor is liable for damage where it has not complied with obligations specifically directed to processors or has acted contrary to lawful instructions. For sub-processors, the initial processor remains liable to the controller (Art. 28(4)).

More questions? We're happy to help. Send email · Try 7 days (credit card required)

Sources and status

Last checked on 4 October 2026 · SimpleAct editorial team

This page and the checklist are for orientation only and do not constitute legal advice. The text of the GDPR published in the Official Journal of the EU is authoritative. Review points for AI vendors, the approach and the examples are recommendations.

Changes to this page

4 October 2026 – Rebuilt: mandatory content of Art. 28(3) as a table, delimitation of roles, review list for AI vendors, interactive DPA checklist with request text, third-country section.
6 July 2026 – DPA and AVV explained in the title and first FAQ.
14 June 2026 – First version.

Processors under control

SimpleAct keeps processors, contracts and evidence in one place and links them to the records of processing and TOMs – overdue reviews are flagged at a glance.

Book a demo Try 7 days (credit card required)