What is a data processing agreement (DPA) and what must it contain?

You are starting with a new accounting package. In the ordering flow there is a box: I agree to the data processing agreement. You tick it, because you want to move on. This piece explains what you have agreed to and what it should contain.

What is a DPA? The meaning in plain language

In this context, DPA stands for data processing agreement, in Dutch the verwerkersovereenkomst. It is the contract between you and a supplier that processes personal data on your behalf. Noveu uses the same combination: our page is called Verwerkersovereenkomst (DPA).

The GDPR gives both parties a name. The controller determines the purposes and means of the processing. That is you. The processor processes personal data on behalf of the controller. That is your supplier (GDPR Article 4(7) and (8), EUR-Lex, accessed 12 October 2026). The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) explains more on its page about the data processing agreement, accessed 12 October 2026.

When do you need one?

Always, when a supplier processes personal data on your behalf. Think of an accounting package, an email solution or a CRM. Article 28(1) GDPR says that a controller shall use only processors that provide sufficient guarantees for appropriate technical and organisational measures. Paragraph 3 says that the processing is governed by a contract. Paragraph 9 says that this contract is in writing, including in electronic form (Article 28, EUR-Lex, accessed 12 October 2026).

What must it contain under Article 28(3)?

Article 28(3) first lists what the contract must set out. Then follow eight points on which the processor commits itself, the letters a to h. Below, each point is explained in plain language.

• The description of the processing. The contract names the subject matter and duration, the nature and purpose, the type of personal data, the categories of data subjects and the rights and obligations of the controller. Watch out: is your data in it, such as that of customers and staff, and do the purposes match what you do with the service?
• Only on your instructions (point a). The processor processes the data only on documented instructions from you, including with regard to transfers to a third country, unless Union or Member State law requires the processor to process; in that case it informs you beforehand, unless that law prohibits this on important grounds of public interest. Watch out: where are your instructions recorded, and does the text mention transfers outside the EU?
• Confidentiality (point b). Anyone with access to the data is bound to confidentiality by an agreement or a statutory obligation. Watch out: does this apply to everyone with access to the data, including hired staff?
• Security (point c). The processor takes all measures required by Article 32. That article names, among other things, the encryption of personal data and the ability to restore data in a timely manner after an incident. Watch out: is there an annex with concrete measures, or does it only say 'appropriate measures'?
• Sub-processors (point d). If the processor engages another processor, it meets the conditions of Article 28(2) and (4). Watch out: read the next heading.
• Help with the rights of data subjects (point e). The processor helps you, insofar as possible, with requests from people exercising their rights, such as access or erasure. Watch out: within what period does it help, and what does that cost?
• Help with security, data breaches and risk assessments (point f). The processor helps you with your obligations under Articles 32 to 36. These include notifying a data breach to the supervisory authority and the data protection impact assessment. Watch out: how quickly do you hear about a data breach? You notify a data breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk (Article 33(1)).
• Deleting or returning (point g). After the end of the services, the processor deletes all personal data or returns it to you, at your choice, and deletes existing copies, unless Union or Member State law requires storage. Watch out: in what format and within what period do you get your data back, and what about backups?
• Information and audits (point h). The processor gives you all the information needed to demonstrate that it complies with Article 28, and contributes to audits and inspections by you or by an auditor you mandate. If it believes that an instruction from you infringes the GDPR, it informs you immediately. Watch out: how often may you request an audit, with what notice, and who pays?

This is a summary and not legal advice. The text of the law prevails.

What happens with sub-processors and transfers outside the EU?

A sub-processor is another processor that your supplier engages. According to Article 28(2), the processor does not do that without prior specific or general written authorisation from you. In the case of general authorisation, it informs you of intended additions or replacements, and you can object to them. Paragraph 4 says that the sub-processor is given the same obligations, and that your supplier remains fully liable if the sub-processor does not fulfil them (Article 28, EUR-Lex, accessed 12 October 2026).

Also look at where data goes. According to Article 44, personal data may only go to a third country if the conditions of Chapter V are complied with. Usually that happens with an adequacy decision of the European Commission (Article 45) or with appropriate safeguards, for example standard data protection clauses (Article 46). Article 49 also provides derogations for specific situations (same source). Ask your supplier for the list of sub-processors and set out side by side for each sub-processor: in which country is it based, where is the data processed and on what basis does a transfer take place? 'Our servers are in the EU' only answers the middle question.

Five mistakes you can easily avoid

• Clicking agree without reading the annexes.
• Reading 'data in the EU' as 'no transfer'. A sub-processor or an administrator can be located elsewhere.
• No agreement on how quickly a data breach is reported. Your notification to the supervisory authority must be made without undue delay and, where feasible, within 72 hours of becoming aware of it.
• No plan for the end of the contract. Ask beforehand in what format your data comes back and when it is deleted.
• Not keeping the version you agreed to. A data processing agreement changes, and then you want to know what applied when you supplied your data.

What can you do this week?

1. Make a list of the suppliers that process personal data of your customers or staff.
2. For each supplier, look up the data processing agreement and note the version and the date.
3. Go through the nine points above and ask in writing for what is missing, plus the current list of sub-processors.
4. Put a reminder in your calendar to repeat this every year.

Where Noveu fits

You can read our agreements on the processing of personal data on our Data processing agreement page. The technical and organisational measures, the sub-processors and the processing activities are in the annexes. Below is a summary of some of the agreements:

• Sub-processors: Noveu asks for general authorisation, announces an addition or replacement in writing at least 30 days in advance and lets you object. If the consultation does not lead to agreement within 14 days, you may terminate the contract with a notice period of 30 days, without compensation (article 6).
• Data breaches: Noveu notifies you of a data breach within 48 hours of discovery at the latest (article 7).
• Rights of data subjects: Noveu supports you within 30 days of a written request (article 8).
• Audit: once per calendar year, with written notice at least 20 working days in advance (article 10).
• End of the contract: on request you get your data back within 30 days in a common format. After that, Noveu deletes it within 30 days, and backups are overwritten or deleted no later than 90 days after termination (article 11).
• Data location: Noveu stores data and backups in a Hetzner data centre in Falkenstein (Germany). Cloudflare, Inc. is established in the US and, according to that page, is the only remaining sub-processor with a US nexus. As safeguards, the page names the EU-US Data Privacy Framework, standard clauses and a data processing agreement, and it says that Cloudflare processes traffic in a global network.

The version on that page prevails, not this summary. The current status of the sub-processors is on the list of sub-processors. What Noveu Werkplek costs, you can see on the pricing page.