5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Have your data processing agreement (DPA) reviewed
A standard DPA is not yet an approval.
A standard contract does not relieve your company. We review and negotiate DPAs from SaaS, cloud and AI providers. Before approval, you learn whether roles, TOMs, sub-processors and transfers are robustly regulated. We review DPAs for SaaS, cloud and AI service providers before approval.
The first contact is free of charge. Before any costs arise, we will tell you expressly.
Response within 24 hours on working daysGo through the minimum content first in the DPA check
As of: 23 October 2026
Data Processing Agreement (standard)
- § 6Technical measuresThe provider takes appropriate measures according to the state of the art.TOM annex without substanceCritical
- § 8Sub-processorsThe provider may engage further sub-processors at any time.No right to objectCritical
- § 10Audit rightsEvidence is provided only through the provider's certificates.Audit practically emptyCheck
- § 12Return and deletionAfter the contract ends, data are deleted within a reasonable period.Standard
Point of review: Sub-processors without the controller's right to object
- 1Gather documentsDPA, main contract, TOMs, sub-processors
- 2Prioritise pointsRedlines and priorities
- 3NegotiateProvider decides on changes
Schematic illustration of a typical provider DPA. Clauses and markings are simplified and do not replace a review.
We review DPAs for
- SaaS and cloud
- Hosting and customer service
- CRM, HR, marketing
- AI tools
- Enterprise deals
Key points at a glance
- At ITMR, we check whether processing on behalf exists at all and whether TOMs, sub-processors, transfers, audits and deletion fit the actual use.
- In our experience, a provider's standard DPA is rarely fit for approval without review, because weaknesses often lie in TOMs, sub-processors, audit mechanics, deletion and the order of precedence with the main contract.
- We separate risks relevant to approval from cosmetic flaws and only negotiate what really affects approval, liability or customer commitments.
- Whether the provider accepts changes is its own decision.
- Approval is decided by your company.
- Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.
- AVV
- Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on your behalf.
- SaaS
- Software as a Service. Software used over the internet rather than installed.
- TOM
- Technical and organisational measures. Companies use them to protect personal data.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
Reason for instruction
What to do when a provider sends its standard DPA?
In our experience, the real pressure usually sits in the same place. The tool is to go live, procurement wants to close and the data protection team sees open points.
A document can fit technically and still not be legally sufficient.
The need does not arise from textbook knowledge but under pressure to decide. A provider demands a signature at short notice, an enterprise customer blocks onboarding or the provider changes sub-processors, locations or TOMs.
Our main data protection law page answers fundamental questions. This page covers the narrower special case: DPA review, DPA negotiation and robust approval when external providers process personal data for your company.
- What is on the table?
- The provider's DPA, usually with a TOM annex and sub-processor list
- Who is waiting?
- Procurement, the business unit, data protection, security or an enterprise customer
- What is coming up?
- Go-live, contract signing, vendor onboarding or audit
- Where is the risk?
- Roles, service provider chain, third-country links, audit, deletion and liability
Shortly before go-live. The tool has been approved by the business unit, but the contractual position has not. Typical for CRM, ticketing, collaboration, HR, finance, marketing and AI tools with open points on roles, TOMs, support access, deletion or sub-processors.
Enterprise sales. The customer wants a vendor package, DPA, SCCs and robust statements on the service provider chain. In our experience, contract quality often directly determines approval, the procurement process and time to signature.
International links. US providers, global support structures or changing sub-processor lists increase review pressure. Transfer mechanics, access scenarios, SCCs, TIA and operational reality must fit together.
Existing providers. Contracts already exist but no longer cover today's use. In our experience, this often happens after product expansion, a new AI feature, extended logging, remote customer service, group integration or data migration.
Approval instead of textbook
The aim is not an abstract textbook solution but a robust basis for approval for onboarding, launch, enterprise sales or audit. The decision is made by your company.
Negotiation and implementation
How do we conduct DPA negotiations in three steps?
In our experience, a good DPA rarely results from wording every clause as harshly as possible. We clarify what is resolved, what is documented and what is consciously accepted. We respond on working days within 24 hours.
01
Gather documents We read the DPA, main contract, TOMs, sub-processor list, security documents, SCCs, TIA and product description together, not in isolation. The DPA, main contract, TOM annex, sub-processor list and planned use are enough to get started.
- DPAavailable
- TOM annexavailable
- Sub-processor listmissing
02
Prioritise points We separate risks relevant to approval from mere cosmetic flaws. This keeps the negotiation focused on what counts operationally and in regulatory terms. We assess whether processing on behalf fits at all and mark the points that must be negotiated or documented before approval.
- Sub-processors
- critical
- Audit
- review
- Deletion
- standard
03
Negotiate Depending on the provider, deal size and alternatives, we choose a mark-up, side letter, additional annex, documentation solution or conscious approval with a management decision. Procurement, data protection, security and the business unit follow the same line. Later questions from the customer, internal audit or the authority remain answerable. You go into procurement, DPO approval, negotiation or rollout with clear redlines, priorities and a clean next step.
How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.
Review focus
What do we review and tighten in the DPA?
Service package: DPA review
Roles and scope of services Distinguishing controller, processor and subcontractor. Purpose, scope, data types, data subjects and admin, customer service, analytics and AI functions.
TOMs and audit TOM annex checked for substance and currency. Evidence and audit mechanics with real practical value, aligned with security questionnaires, certifications and vendor review.
Sub-processors and transfers Approval model and change mechanism for sub-processors. EEA locations, remote access, group support and the interface with SCCs and TIA.
Exit and liability Return, deletion, data portability and exit support. Liability and indemnity in relation to the main contract, and cooperation on access requests, incidents and contact with authorities.
- Area of law
- Data protection law, IT contract law
- For whom
- Companies buying tools and SaaS providers needing DPA packages for customers
- First response
- within 24 hours on working days
- Initial contact
- free of charge, to clarify the topic, responsibility and next step
- Costs
- We inform you expressly in advance. Only then do you decide.
- Result
- Redlines, priorities, negotiation line and documented basis for approval
- Not included
- Negotiations directly with the provider's sub-processors and proceedings before the supervisory authority. This is a separate service, on request and as needed.
Who delivers what and who decides
- DPA and main contract
- TOM annex and sub-processor list
- Short description of the planned use
- Role classification and clause review
- Redlines and priorities
- Negotiation with the provider
- Documentation of approval
- It decides which changes it accepts
- It provides evidence, TOMs and sub-processor information
- Your company with procurement, data protection and security
- Management, if residual risk is consciously accepted
How does the engagement work?
- 1
First assessment We review your information and tell you whether the package fits or another route makes more sense.
- 2
Offer for the package If the package fits, you receive a quote for the review, redlines and negotiation line. We only start after your approval.
- 3
Court steps separately Proceedings before the supervisory authority or in court, and representation in them, are not part of the package. We agree these steps separately.
First review questions
Is the DPA presented sufficient?
Before we negotiate clauses, we clarify the basics. Many approvals fail not because of wording but because of a wrong classification.
Not every engagement of a service provider falls under Art. 28 GDPR. It depends on whether the provider processes on instructions or co-decides on purposes and essential means.
A formally clean contract helps little if support access, log data, backups, sub-processors or AI functions work differently in operation than on paper.
If providers, admin access or subcontractors outside the EEA are involved, the DPA review alone is usually not enough. The transfer basis and evidence are part of it.
Not every cosmetic flaw needs to be escalated. What matters are points affecting approval, auditability, liability, customer commitments or robustness towards the authority.
Typical case scenarios
When does the DPA review become economically relevant?
The constellations differ greatly. We classify your case and check where the risk actually lies.
| Situation | Typical constellation | What we review |
|---|---|---|
| SaaS and cloud | CRM, ERP, HR, ATS, customer service, collaboration, cloud hosting, managed services, backup, monitoring | Whether the standard DPA suffices as the only basis for negotiation, including with white-label and API chains |
| Agencies and external teams | Marketing automation, newsletters, lead handling, ad tech, customer service, BPO, external administration | Where services, access and responsibility merge and mixed roles arise |
| Vendor onboarding | Data protection and procurement approval depend on the same clauses | TOM annex, sub-processor reservations, deletion and return, audit rights, order of precedence with the main contract |
| Customer sales | Your own contract documents must become enterprise-ready | DPA package, alignment with the SaaS contract, SLA and security annexes, answers on storage location and support model |
A common fallacy is that a data flow automatically requires a DPA. Whoever decides on purposes and essential means can shift the focus to separate or joint controllership. Our GDPR role simulator offers an initial classification.
Negotiation lines
Which line fits the provider?
If the provider only accepts standard terms, the question is which points must be resolved before approval. Others can be documented or consciously accepted.
| Criterion | Mark-up | Side letter or additional annex | Documentation solution | Conscious approval |
|---|---|---|---|---|
| When it fits | The provider negotiates its contract | The provider does not change its template but accepts additions | The risk can be covered by evidence and internal documentation | A residual risk remains and is economically justifiable |
| What we prepare | Redlines in the contract text | Supplementary provisions with a clear order of precedence | Review memo and list of evidence | Decision paper with risk description |
| Who decides | The provider | The provider | Your data protection and security teams | Your management |
Typical mandates
What we are brought in for in DPA mandates
In our experience, the DPA is often only part of the actual risk. We therefore review it together with the contracts and processes that depend on it.
Review the DPA of a SaaS or cloud provider and negotiate critical clauses in the standard DPA.
Align the DPA, SCCs and TIA when providers or access are outside the EEA.
Adapt contracts to today's use after product or process changes.
Speed up vendor onboarding and set up your own DPA package for customer sales.
Structure both documents without contradictions, including SLA, exit and security annexes.
Build on the contractual position in a data breach or privacy litigation.
Preparation
Which documents speed up the review?
A few documents are enough to start. The more completely the service provider chain is described, the more precise the prioritisation.
- DPA The provider's draft or your own template is the basis for the clause review.
- Main contract or order documents Order of precedence, liability, exit and SLA depend on the main contract.
TOM annex It shows whether security is described in substance or merely claimed.
Sub-processor list It shows the service provider chain, locations and possible third-country links.Hosting information Storage location, support model and remote access determine transfer questions.Planned use A short description of what the tool is to be approved for internally.
Legal basis
What does Art. 28 GDPR require of the DPA?
Anyone using a processor must conclude a contract under Art. 28 GDPR. It can be in writing or in electronic form. Individual provisions or standard contractual clauses of the European Commission or a supervisory authority are possible.
The service provider may only engage further processors with the controller's prior authorisation. It must notify later changes in advance, and the controller can object. This is how the German Data Protection Conference summarises it in its Short Paper No. 13.
Whether a provider is a processor, a separate controller or a joint controller depends on the actual decisions on purposes and means. The European Data Protection Board's Guidelines 07/2020 explain this distinction.
The European Commission has published standard contractual clauses under Art. 28(7) GDPR. They can serve as a contractual basis but do not replace the review of whether they fit the actual processing.
- DSK Short Paper No. 13: processing on behalf, Art. 28 GDPR Form of contract, sub-processors, right to object and duties of the parties.
- EDPB Guidelines 07/2020 on controller and processor Distinguishing roles by purposes and essential means of processing.
- European Commission: standard contractual clauses Art. 28 Implementing decision with clauses under Art. 28(7) GDPR.
Limits
When another page is a better fit
Not every data protection case is a DPA case. We tell you openly when the focus lies elsewhere.
- 1
Fundamental questions Data protection governance, access requests, tracking or DPIA are covered on the main data protection law page.
- 2
Focus on third-country transfers If SCCs, TIA or global support structures are the focus, data transfers are the right starting point.
- 3
Incident has occurred If the service provider relationship has already led to a notifiable data breach, the data breach help page will help.
What makes approval unnecessarily risky
- The standard DPA is signed without review because go-live is pressing.
- A DPA is concluded although the provider is actually a controller itself.
- The TOM annex describes security only in general terms.
- Sub-processors may be changed without a right to object.
- The DPA is concluded after go-live instead of beforehand.
- A template from the internet replaces the review of practical special cases.
Your contact
Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“We would like to thank you once again for your support in drafting the contract for the sale of software. Thanks to your advice, we were able to conclude a very good contract for us, with which we are extremely satisfied.” (translated from German)
“Great advice and service. Any time again.” (translated from German)
“Mr Skornia took a lot of time and answered the questions on the GDPR rules in detail, competently and clearly. Happy to come back!” (translated from German)
FAQ
Questions before approval
When is a DPA mandatory?
A DPA is generally required when an external service provider processes personal data on instructions on behalf of your company. Whether this is the case depends on the scope of services and the allocation of roles, not on the title of the contract.
Is the provider's standard DPA sufficient?
Usually not without review. Many templates are usable but have weaknesses in TOMs, subcontractors, audit mechanics, deletion, liability or alignment with the main contract.
Must the DPA be concluded before go-live?
If there is processing on behalf, the contractual basis should be in place before processing starts. Catching up later significantly increases approval, evidence and liability risks.
What applies to US providers or worldwide customer service?
Then reviewing the DPA is not enough. Third-country transfers, SCCs, TIA, remote access, group support and the actual sub-processor structure also matter.
Do you review only the DPA or the rest of the contract too?
Both are possible. In our experience, the DPA is often only part of the risk. We then review the SaaS contract, SLA, exit, security annexes and data transfers at the same time.
Is a DPA template from the internet enough?
Perhaps for orientation. For tools in use, enterprise deals or international providers, a template is usually not enough, because the practical special cases and interfaces are missing.
May the provider change sub-processors freely?
No. Further processors require the controller's prior authorisation. With a general authorisation, the provider must notify changes in advance so that an objection is possible.
Must the DPA be signed on paper?
No. The contract can be in writing or in electronic form. What matters is that the content fits the actual processing.
Next step
Align your DPA case before approval becomes pressing
Whether SaaS tool, hosting, customer service, agency structure or international provider: what matters is whether your contractual position fits the actual processing and is fit for internal approval. A clear line helps more than another template.
This helps us with the first review
- DPA
- Main contract or order documents
- TOM annex
- Sub-processor list
- Hosting information
- Short description of the planned use
We review, prioritise and negotiate where a DPA becomes economically relevant. Approval remains your decision.
Classify your DPA now
Align DPA approval
Helpful are the DPA, main contract or order documents, TOM annex, sub-processor list, hosting information and a short description of the planned use.
Related services
Data protection law For fundamental questions, governance, access requests, tracking, DPIA and broader GDPR compliance.Data transfer When third-country transfers, SCCs, TIA or global support structures are the focus.IT contract / software contract When scope of services, SLA, exit, warranty and contract architecture are the focus.Data breach assistance When the service provider relationship has already turned into an incident or acute pressure to respond.IT-Outsourcing-Vertrag Negotiating outsourcing.
From our blog: DPA check · GDPR role simulator · Joint controllership