# Regulatory Standards — DPA Drafting

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 28(3)**: The core provision requiring a binding contract between controller and processor. All eight sub-paragraphs (a) through (h) must be addressed. The contract must set out the subject-matter and duration of processing, the nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller.

- **Article 28(4)**: Where a processor engages another processor for carrying out specific processing activities, the same data protection obligations as set out in the controller-processor contract shall be imposed on that other processor by way of a contract, in particular providing sufficient guarantees.

- **Article 28(9)**: The contract shall be in writing, including in electronic form. This confirms that digital/electronic DPAs are valid.

- **Article 28(10)**: If a processor processes personal data beyond or contrary to instructions, the processor shall be considered a controller for that processing and shall be subject to the corresponding provisions.

- **Article 32**: Security of processing. Referenced in Article 28(3)(c) as an obligation the processor must fulfill. Includes pseudonymisation, encryption, confidentiality, integrity, availability, resilience, disaster recovery, and regular testing.

- **Article 33(2)**: Processor shall notify the controller without undue delay after becoming aware of a personal data breach. This obligation must be reflected in the DPA with specific timeframes.

- **Articles 44-49**: Chapter V on international transfers. Where processing involves transfers to third countries, the DPA must address the transfer mechanism (adequacy, SCCs, BCRs, or derogations).

### Commission Implementing Decision (EU) 2021/915

Adopted 4 June 2021, these Standard Contractual Clauses for Article 28(3)/(4) processing arrangements provide a reference framework:

- **Clause 7**: Description of processing (Annex I)
- **Clause 7.1**: Instructions — processor acts only on documented controller instructions
- **Clause 7.2**: Purpose limitation — personal data processed only for the specific purpose(s) set out in Annex I
- **Clause 7.7**: Sub-processing — detailed sub-processor approval and flow-down mechanism
- **Clause 7.8**: International transfers — incorporation of transfer mechanisms
- **Clause 8**: Assistance to the controller
- **Clause 9**: Data subject rights
- **Clause 10**: Notification of personal data breaches

### EDPB Guidelines 07/2020 on Controller and Processor Concepts

- **Paragraphs 97-120**: Detailed guidance on the content requirements of Article 28(3) contracts
- **Paragraph 100**: The contract must not merely repeat Article 28(3) verbatim — it must contain specific details relevant to the actual processing
- **Paragraph 105**: The description of processing must be sufficiently detailed to allow meaningful controller oversight
- **Paragraph 110**: Audit rights must be practical and exercisable, not merely theoretical
- **Paragraph 115**: Sub-processor provisions must include a genuine objection mechanism

## Supervisory Authority Enforcement

### EDPS Enforcement — Europol DPA Decision (January 2022)

The European Data Protection Supervisor found deficiencies in data processing arrangements, emphasizing that DPA requirements apply regardless of the parties' sophistication and that all mandatory provisions must be individually addressed.

### Dutch DPA — Municipality Fine for Inadequate DPA (2021)

The Autoriteit Persoonsgegevens fined a municipality for executing a DPA that failed to specify data categories, data subject categories, and processing locations with sufficient specificity. The DPA referenced "all personal data processed in the context of the agreement" — deemed insufficient.

### Spanish DPA (AEPD) — DPA Specificity Requirement

The AEPD has consistently held that DPAs must contain specific operational detail, not generic provisions. In multiple decisions, the AEPD found that boilerplate DPAs without annexes detailing the actual processing were non-compliant with Article 28(3).

### Hamburg DPA — Processor Liability for Exceeding Instructions

The Hamburg DPA confirmed that under Article 28(10), a processor that exceeds or departs from documented controller instructions becomes a controller for that processing, with full GDPR obligations and liability.