DPA check

Do you need a DPA – and is your DPA structure robust?

This interactive check helps companies, SaaS providers, agencies, platform operators and digital business models with an initial assessment of whether there is processing on behalf under Art. 28 GDPR, joint controllership under Art. 26 GDPR or rather separate controllership.

Start check

Art. 28 GDPR Role allocation TOMs & sub-processors Third-country transfer DPIA and breach interfaces

What it is about in practice

A DPA is not just a form. What matters is who decides on the purposes and essential means, whether personal data is processed, whether the service provider has its own purposes and whether sub-processors, international access, TOMs, deletion, audit rights and support obligations are properly regulated.

Clarify the role model before signing a contract, go-live, a tool change or vendor approval.
Check DPA clauses, TOMs, sub-processors and transfer mechanisms against the actual processing.
Keep evidence and responsibilities readily available for data breaches, data subject requests or audits.

Role logic

From data access to the right contract structure

Processing on behalfProcessing bound by instructions without the service provider's own purposes.

Joint controllershipSeveral parties jointly determine purposes or essential means.

Separate controllershipThe recipient uses data for its own purposes and needs its own legal basis; a processor that itself determines purposes and means is considered a controller in that respect (Art. 28(10) GDPR).

Review path

Six steps to an initial assessment

1Personal data

Which data, data subjects and systems are affected?

2Role model

Who determines purpose, means, retention period and recipients?

3DPA clauses

Check nature, purpose, data types, TOMs, instructions, deletion and audits.

4Sub-processors

Authorisation, transparency, notice periods and flow-down of equal obligations.

5Interfaces

Consider third-country transfers, DPIA, TDDDG, AI, cloud, NIS2/CRA and incident processes.

6Priority

Contract signing, customer, DPO, audit, authority or data breach determine the pressure to act.

Assessment

What this check does

The check does not replace a review of the individual case, but it structures typical decision points for DPA constellations. It combines the data protection role allocation with practical evidence, contract clauses and interfaces to digital regulation.

When is processing on behalf likely?

Processing on behalf is usually likely if a service provider processes personal data exclusively for the documented purpose of the client, pursues no purposes of its own and only determines technical or organisational detailed means.

When is a DPA probably not enough?

A pure DPA may be unsuitable if the service provider uses data for its own purposes such as product improvement, benchmarking, AI training, its own advertising or independent security analyses. The processing must then be split up or regulated differently.

Which interfaces are particularly important?

Particularly relevant are third-country transfers, sub-processors, TOMs, data breach processes, data subject rights, DPIA obligations, TDDDG tracking, AI tools, cloud switching, Data Act aspects and security evidence.

What are the limits of the check?

The assessment depends on the specific processing operation, the contracts, actual use, the technical setup and role practice. The result is therefore an initial orientation and not conclusive legal advice.

Interactive check

Review your DPA constellation

Answer the following questions. At the end you receive a preliminary assessment with risk level, priority, review points, a list of documents and a copyable short overview for your inquiry.

Step 1 of 6

1. Which constellation should be reviewed? We engage a service providerSaaS, hosting, IT support, newsletter tool, CRM, payroll, agency, call centre or cloud service. We process data for customersYour company offers a service and processes personal data for customers in doing so. Sub-processing / sub-processor chainA service provider uses further service providers or your company is itself a sub-processor. Service provider also uses data for its own purposesProduct improvement, analytics, benchmarking, AI training, fraud prevention or its own marketing. Joint project with a partnerJoint platform, campaign, event, lead pool, database, app or tracking setup. Data transfer to an independently acting partyThe recipient then decides itself on its own purposes, legal basis and retention periods. Unclear / roles are currently being discussedThe customer, purchasing, data protection officer, auditor or provider is unsure whether a DPA fits.

2. Which data is processed?

Please mark everything that applies.

Ordinary personal dataName, email, address, phone number, customer number, account data or communication data. Employee, applicant or HR dataPersonnel files, payroll, applications, performance data, working time or internal communication. Special categories or sensitive dataHealth, biometric data, political opinions, religion, trade union membership or comparably sensitive information. Access data, logs or security dataPasswords, tokens, IP addresses, log files, admin access, support access or security events. Large scale or ongoing processingMany data subjects, permanent platform use, synchronisation, monitoring or automated processing. International access or third-country transferUS providers, global support teams, international sub-processors, cloud regions or remote access from third countries. No personal data or still unclearIt is open whether personal data is processed at all.

3. Who determines purpose, means and use?

Please mark everything that applies.

The client determines the purposeThe customer or controller decides why the data is processed. Processing only on documented instructionsThe service provider may only process data according to the contract, instructions or approved scope of services. No own use by the service providerNo own advertising, analysis, product improvement, AI training, profiling or data enrichment. Service provider only determines technical detailed meansHosting architecture, security measures, backup, support processes or technical implementation. Service provider uses data for its own purposesAnalytics, product improvement, benchmarking, AI training, fraud prevention, marketing or its own database. Several parties jointly determine purpose or meansJoint decision on campaign, platform, tracking, target groups, data scope or recipients. Recipient uses data for its own separate purposesAfter the transfer, each party independently decides on further use, legal basis and retention period. Unclear / not documentedIt is not clear who determines purpose, means, data scope and retention period.

5. Which interfaces or additional risks exist?

Please mark everything that applies.

Third-country transfer or international support accessSCCs, TIA, EU-US Data Privacy Framework, supplementary measures and sub-processors must be reviewed. High risk / possible DPIAMonitoring, scoring, sensitive data, HR context, large data volumes or new technologies. AI tool, AI training or automated analysisClarify own purposes, training data, output review, transparency, GDPR and AI Act interfaces. Tracking, cookies or terminal device accessAdditionally review TDDDG, consent, analytics, marketing tags and data flows. Cloud, data access or Data Act relevanceCloud switching, data portability, data access processes and trade secrets may be relevant. Security, NIS2 or CRA interfaceSupply chain, incident response, vulnerability handling, SBOM or product cybersecurity may become relevant. Breach or data subject rights process unclearReporting chains, 72-hour assessment, access, deletion, support obligations and evidence are missing or unclear. No additional risks knownNo further interfaces are currently apparent.

6. Is there specific pressure to act?

Please mark everything that applies.

The contract is to be signed shortlyThe DPA must be clarified before signing, go-live or vendor approval. Customer, purchasing or data protection officer requests a DPAA DPA questionnaire, redlines, audit, procurement requirement or vendor assessment has been received. Service provider refuses a DPA or offers the wrong modelThe provider does not want to conclude a DPA or claims its own controllership. New sub-processor, tool change or international accessNew cloud, AI provider, support access, tracking tool or subcontractor. Data breach, security incident or data subject requestAn incident, access request, deletion, complaint or contact from an authority concerns service provider data. Audit, supervisory authority or group reviewEvidence on the DPA chain, TOMs, sub-processors or third-country transfers is requested. Preventive reviewNo acute deadline, but contract templates, tool stack or the DPA process should be put in order.

Risks & deadlines

Typical DPA risks and measures

Signal	Why relevant?	Typical measure	Priority
No DPA despite processing bound by instructions	Art. 28(3) GDPR requires a contract or other legal act with specific minimum content; the Commission's standard contractual clauses (Implementing Decision (EU) 2021/915) can be used.	Set up a DPA, synchronise the main contract, document processing and TOMs.	hoch
Service provider's own purposes	A pure DPA usually does not properly reflect separate processing parts.	Separate roles, review legal bases, adapt privacy notices and contracts.	kritisch
Third-country transfer or international access	Transfer mechanisms, SCCs, TIA, sub-processors and supplementary measures may be required.	Review the transfer register, SCC/TIA, support locations and safeguards.	hoch
Data breach at the service provider	Controllers must generally be able to assess GDPR notification duties within 72 hours.	Secure the breach runbook, escalation chain, logs, DPA support and communication.	kritisch
Data subject rights affected	Access, erasure and other rights must generally be handled within one month.	Define the process, responsibilities, identity verification, data export and deletion logic.	hoch
Sub-processors or tool change	Duty to inform, authorisation, objection, TOMs and transfer situation may change.	Update the sub-processor list, change process, customer evidence and contract chain.	medium to high

Sensible next steps

Related ITMR checkers and follow-up reviews

GDPR role simulatorHelps to distinguish between controller, processor and joint controllership. Third-country transfer checkChecks international access, SCCs, TIA, EU-US Data Privacy Framework and transfer evidence. DPIA checkAssesses whether a data protection impact assessment is likely for sensitive or high-risk processing. Data breach risk checkStructures the 72-hour assessment, reporting chain, service provider role and evidence preservation in incidents. SaaS contract checkLinks DPA, service description, SLA, support, liability, sub-processors and exit provisions. Document dossier builderHelps prepare the DPA, TOMs, record of processing, sub-processor list, transfer documents and audit evidence in an orderly way.

Have your DPA structure reviewed specifically

If a contract signing, customer audit, tool change, third-country transfer, sub-processor change or incident is coming up, the role and DPA structure should be reviewed on the basis of the specific documents.

Send an inquiry about the DPA check

Legal orientation note

This checker provides a structured initial orientation. It does not replace a legal review of the specific processing operation, the contract documents, the technical implementation, the sub-processor chain, the actual instructions and the international data flows. How we review and negotiate data processing agreements is explained under Data processing agreement; further basics can be found in the area of Data protection law.

Do you need a DPA – and is your DPA structure robust?

What it is about in practice

From data access to the right contract structure

Six steps to an initial assessment

What this check does

Review your DPA constellation

Why this result?

Recommended next review points

Documents worth preparing

Typical DPA risks and measures

Related ITMR checkers and follow-up reviews

Have your DPA structure reviewed specifically

Legal orientation note