Data Processing Agreement

A DPA is needed whenever you transfer personal data to a service provider that acts under your instructions for the specific purposes you have defined — what is called a processor. The same need appears if your company acts as a service provider for another company.

Under the EU-GDPR, Art. 28 requires coverage of the purpose, duration and nature of the processing, confidentiality obligations on the processor's staff, the processor's duty to act only under the controller's instructions, assistance with data subjects' rights, data security and general GDPR compliance. Under Swiss law, the controller must also ensure the processor guarantees security and integrity of personal data, restricts sub-processing to previously authorised parties, and reports data breaches to the controller.

It can, but it needs to obtain authorisation from the controller as defined in the DPA. This can be done on a case-by-case basis, where the processor requests authorisation each time it wants to engage a new sub-processor, or through a general authorisation included in the DPA that allows the processor to engage new sub-processors going forward.

In certain cases, personal data is not transferred to a processor but to another company that, jointly with yours, also determines the purposes and means of the processing. In these cases, under the EU-GDPR, this relationship also needs to be governed by a contract in which the joint controllers determine their respective responsibilities — in particular how they will comply with data subjects' rights and provide appropriate privacy notices.

Yes. If you are in the SaaS business and your platform processes personal data on behalf of your customers (who are the controllers), you act as a processor and are legally required to offer a DPA. Our free generator and expert team can help you produce a compliant, customer-ready DPA quickly.