Data processing agreement template
The mandatory agreement with a supplier who processes your customers' data
This document rests on a fixed pattern prepared by Paragrafo; it is not a law firm template. Its wording is not written by AI, only the details from the form are filled in. For a non-standard situation we recommend a solicitor.
Law in force as at
Zmluva o spracúvaní osobných údajov
- I. Zmluvné strany
- II. Predmet zmluvy
- III. Predmet, povaha, účel a doba spracúvania
- IV. Pokyny prevádzkovateľa
- V. Práva a povinnosti prevádzkovateľa
- VI. Dôvernosť
When someone processes your customers' personal data on your behalf, you need a written processing agreement with them. This is not limited to large systems: it applies equally to hosting, an accountant, an email tool, a courier or outsourced support.
This is not a recommendation, it is an obligation. The Regulation states that processing by a processor is governed by a contract, and it lists what that contract must contain. The controller, meaning you, needs the agreement even when the supplier offers its own template.
A common misconception is that a published privacy policy is enough. That tells your customers what you do with their data. A processing agreement covers something else: what your supplier may do with it.
Who needs this document
- Online shops whose website runs on third-party hosting
- Companies whose books are kept by an external accountant
- Controllers sending newsletters through a third-party service
- Companies using outsourced customer support or a call centre
- Anyone who has entrusted customer data to a software or cloud supplier
- Accountants, IT firms and agencies whose clients ask them for a processing agreement; the template can also be drawn up by the supplier
What the document must contain
- The subject matter and duration of the processing
- The nature and purpose of the processing
- The type of personal data and the categories of data subjects
- An obligation to process only on documented instructions from the controller
- A confidentiality obligation for the people who access the data
- Security measures under Article 32 of Regulation (EU) 2016/679
- The conditions for engaging a sub-processor
- Assistance to the controller with data subject requests and breach notification
- Deletion or return of the data once the service ends
- Provision of information and the ability to audit
Legal basis
Regulation (EU) 2016/679 (GDPR)
Article 28 states that processing by a processor is governed by a contract, and sets out its content and the requirement of written form.
Act No. 18/2018 Coll. on Personal Data Protection
Covers what the Regulation leaves to the member states.
Most common mistakes
Relying on the privacy policy
A published policy tells customers what you do with their data. It says nothing about what the supplier may do with it. They are two separate documents and one does not replace the other.
Accepting the supplier's template unread
Suppliers do offer templates and they tend to be written in their own favour, most often around engaging sub-processors and transfers outside the European Economic Area. That does not shift the controller's responsibility.
No type of data and no categories of data subjects
An agreement that refers only to personal data will not satisfy what the Regulation asks for. The type of data and the categories of data subjects are listed as part of its content.
General authorisation for sub-processors without notification
If the supplier may engage a sub-processor under a general authorisation, it must inform the controller of every change and give it the chance to object. Without that, the authorisation is not the one the Regulation describes.
No arrangement for when the service ends
Once the service ends, the data is deleted or returned at the controller's decision and copies are deleted. Without that clause it stays with the supplier and nobody knows for how long.
An oral arrangement
The agreement is drawn up in writing, including electronic form. A phone call with the supplier does not meet that condition.
An agreement "under § 34 of Act No. 18/2018 Coll."
25 of the 48 processing agreements we reviewed in the Slovak Central Register of Contracts start this way. Where Regulation (EU) 2016/679 applies, however, Part Two of Act No. 18/2018 Coll., including § 34, does not apply (§ 3(2) of Act No. 18/2018 Coll.). The agreement is concluded under Article 28 of Regulation (EU) 2016/679; from the Act, for example the duty of confidentiality under § 79 of Act No. 18/2018 Coll. applies.
Frequently asked questions
Do I need this with a hosting provider that never looks at the data?
If the data sits on their servers, they process it on your behalf even if nobody reads it. Whether the data is accessible affects the scope of the measures, not whether the agreement is needed.
Is an accountant a processor?
When processing on your instructions, yes. Where they have their own statutory duties and decide on the purposes themselves, they act as a separate controller. What matters is who decides on the processing, not who issued the invoice.
Is it enough if the supplier sends me their terms?
It can be, if they contain what the Regulation requires and are in written form. Responsibility for choosing the supplier and for the content of the agreement stays with the controller.
What if the supplier processes the data in the United States?
A transfer outside the European Economic Area is possible only on documented instructions and where the conditions for third-country transfers are met. That is why the agreement states where the processing takes place.
How many such agreements does a typical online shop need?
Usually several: hosting, accounting, email delivery, shipping and possibly outsourced support. Every supplier processing data on your behalf is a separate agreement.
Data processing agreement for your business
You fill in your company details and the document is ready in under a minute.
Generate the document