Processor agreement 2026: checklist for security and privacy teams

Short answer. A processor agreement (data processing agreement, DPA) is mandatory as soon as another party processes personal data on your behalf, such as a SaaS vendor, a payroll provider or a hosting company. Article 28 of the GDPR sets out its minimum content. For ISO 27001 and ISO 27701 the agreement is also evidence of supplier management. The checklist below helps you review a vendor’s draft in half an hour.

When do you need a processor agreement?

The GDPR distinguishes the controller, who decides why and how personal data is processed, from the processor, who processes it on the controller’s behalf. If you use a cloud CRM, an email service, an accounting package or an external IT administrator with access to your data, that party is usually a processor and an agreement (or another legally binding act) is required. Note that not every supplier is a processor. An accountant or lawyer often decides how to use the data and is then a controller in their own right.

Minimum content under Article 28 GDPR

Check that the agreement covers these points:

1. Subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects.
2. Processing only on your documented instructions, including transfers outside the EEA.
3. Confidentiality for everyone with access to the data.
4. Appropriate security measures under Article 32, preferably described concretely or backed by a certificate.
5. Sub-processors only with your prior authorisation, with the same obligations passed down.
6. Assistance with data subject requests such as access or erasure.
7. Assistance with security, breaches and DPIAs, including a deadline for notifying you of a breach.
8. Deletion or return of data at the end of the service.
9. Information and audits: the processor makes available all information needed to demonstrate compliance and contributes to audits.

Where it goes wrong in practice

Breach notification deadline. You have 72 hours to notify your supervisory authority of a personal data breach. If your vendor notifies “without undue delay”, that may be too late. Ask for a concrete deadline, for example 24 or 48 hours after discovery.

Sub-processors. Many SaaS vendors use a general authorisation and an online sub-processor list. That is allowed, but make sure you are notified of changes and can object. Check the list for where data is physically stored and whether data goes to the United States.

Transfers outside the EEA. Transfers to a country without an adequate level of protection require standard contractual clauses (SCCs) or certification under the EU-US Data Privacy Framework. Record which basis applies.

Audit rights. A physical audit at a large cloud provider is unrealistic. A recent ISO 27001 certificate with a suitable scope or a SOC 2 report is a reasonable substitute, provided you actually request and read it.

Liability. Standard terms often cap liability at one month’s subscription fee. For processing of sensitive data that deserves a conscious decision.

Link with ISO 27001 and ISO 27701

ISO 27001 controls 5.19 to 5.22 require agreements with suppliers and monitoring of them. ISO 27701 adds specific requirements for controllers and processors. An auditor typically samples: show the agreement, the assessment and the last review date for three critical suppliers. Keep a processor register listing per vendor which data it processes, where the agreement is stored and when it was reviewed.

Quick checklist for a draft

• Are all mandatory elements of Article 28 included?
• Is the breach notification deadline concrete and shorter than 72 hours?
• Is the sub-processor list available, and are you notified of changes?
• Is it clear where data is stored and which transfer basis applies?
• Are security measures described or supported by a certificate or report?
• Is it settled what happens to the data on termination, and within what period?
• Is the agreement recorded in your register with a review date?

Further reading

See also the supplier assessment template, processor agreements under GDPR and ISO 27701 and ISO 27701 certification. This guide is educational and not legal advice; involve a lawyer when in doubt.