PIPELINEGlossary · Legal and compliance
What is a data processing agreement?
A data processing agreement defines the conditions under which a service provider processes personal data on behalf of a company. It is mandatory as soon as external providers are involved — for example, for hosting, newsletters, chat, or analytics tools.
01 — Context
Data processing agreement in detail
It specifies which data is processed for what purpose, which security measures apply, whether subprocessors are used, and what happens to the data when the contract ends.
Reputable providers offer such an agreement proactively, usually for acceptance in the customer account. If a provider doesn't offer one, that's a clear warning sign.
02 — Practice
What this means for small businesses
The agreement alone is not enough. You also need a legal basis, purpose limitation, deletion concept, information for data subjects, and verification of whether data is transferred to third countries. In practice, it's worth creating a simple list of all services used — hosting, form submission, newsletter, appointment booking, chat, analytics, accounting — and noting whether an agreement exists and where processing takes place. This list also serves as the foundation for the record of processing activities and becomes outdated much more slowly than most expect.
03 — Questions
Frequently asked questions
Which services do we need this for?
For any service that processes personal data on our behalf — including seemingly harmless ones like appointment booking or form submission.
Who signs?
The responsible company, i.e. the client. In practice, electronic acceptance in the provider's account is usually sufficient.
04 — Continue
Related terms and services
Related services
Next step
Initial assessment, no obligation.
Briefly describe what you need. You'll get an honest answer about what's realistic and what it will roughly cost.