Law · 7 November 2026 · 6 minute read
Data processing agreement: a checklist for web tools
When you need a data processing agreement under Art. 28 GDPR, what it must contain and what to look for with analytics and marketing tools.
Almost every tool you use on your website processes data on your behalf: web analytics, newsletter, CRM, heatmap, chat. As soon as personal data is involved, the GDPR requires a contract with the provider. It is called a data processing agreement, DPA for short. This article explains when you need one, what it must contain and what to bear in mind when choosing a tool.
When you need a DPA
Art. 28 GDPR applies when a service provider processes personal data on your behalf and following your instructions. You are then the controller and the provider is the processor. You will find the legal text in the GDPR on EUR-Lex.
Not every relationship is data processing. You should distinguish three constellations:
| Constellation | Feature | Contract |
|---|---|---|
| Data processing | Provider acts only on your instructions | DPA under Art. 28 |
| Joint controllership | You and the provider decide together on purpose and means | Arrangement under Art. 26 |
| Separate controller | Provider uses the data for its own purposes | Own legal basis and transfer rules, depending on the case |
What matters is who determines purpose and means, not what the contract is called. A provider that also uses the data for its own purposes, for example to improve its own products beyond the service for you, is no longer a processor for that part. Under Art. 28(10), a processor that determines purpose and means itself is considered a controller for that processing.
Mandatory content under Art. 28(3)
The contract must set out the subject matter and duration of the processing, its nature and purpose, the type of data and the categories of data subjects. It must also provide that the processor:
- a) processes the data only on documented instructions, including with regard to transfers to a third country,
- b) uses persons who are committed to confidentiality,
- c) takes the measures required under Art. 32,
- d) respects the conditions for engaging further processors,
- e) assists you with requests from data subjects,
- f) assists you with the obligations under Art. 32 to 36,
- g) at your choice deletes or returns the data after the end of the services,
- h) provides evidence and allows audits.
The contract must be in writing, and an electronic format is sufficient (paragraph 9). The European Commission offers a model framework with the standard contractual clauses for data processing. Under Art. 28(6), the contract can be based on them in whole or in part.
Subprocessors
If the provider itself uses service providers, for example a hosting provider, two rules from Art. 28(2) and (4) apply:
- It needs your prior specific or general written authorisation. With a general authorisation, it must inform you of any intended change. You can then object.
- It must impose the same data protection obligations on the subprocessors. If a subprocessor fails to do so, the first processor is liable to you.
Therefore ask the provider for a current list of its subprocessors, with location and task.
Third countries
If data is processed outside the EU and the EEA, or can be accessed from there, the rules for transfers to third countries (Chapter V, Art. 44 ff. GDPR) also apply. There are three usual routes: an adequacy decision by the Commission, standard contractual clauses for the transfer, or binding corporate rules. For the USA there has been an adequacy decision on the EU-US Data Privacy Framework since 2023. It applies only to companies that participate in the framework. It is being challenged in court, so check the current status. A server in the EU resolves the issue if neither the provider nor a subprocessor from a third country can access the data.
Checklist for analytics and marketing tools
- Clarify the role. Does the provider process only for you or also for its own purposes?
- Check the contract. Are all points from Art. 28(3) in it?
- Describe the data. Are the type of data and the categories of data subjects named specifically?
- Look at the subprocessors. Is there a list and a procedure for changes?
- Ask for the server location. Where is the data stored, and who can access it?
- Document the third-country route. What basis supports a transfer?
- Regulate deletion. What happens to the data after the contract ends?
- Read the technical measures. Encryption, access rights, logging.
File the contract with your documentation and add the tool to your record of processing activities under Art. 30 GDPR. Especially with tools that load only after consent, the contract is a second, separate requirement. Consent on the device does not replace it, as § 25 TDDDG: cookies and tracking in Germany shows.
What is at stake in case of violations
If the contract is missing or incomplete, the supervisory authority can object. For violations of the obligations under Art. 28, Art. 83(4) GDPR provides for fines of up to 10 million euros or up to 2 percent of worldwide annual turnover, whichever is higher. That is the framework, not a forecast for an individual case.
And in Switzerland?
The Swiss Data Protection Act regulates processing by processors in Art. 9 DPA. The idea is similar, the wording different. Anyone who addresses data subjects in the EU generally needs the contract under the GDPR. Whether that applies to your offer is explained in Website tracking in Switzerland: revDSG and FMG.
Frequently asked questions
Do I need a DPA if the tool only displays company names? That depends on whether the provider processes personal data for you in the process, for example IP addresses, even briefly. If in doubt, conclude the contract, it costs almost nothing. Whether an IP address is personal data is explained in IP address and GDPR: is it personal data?.
Is it enough to accept the provider's terms and conditions? Only if they contain all the mandatory content and the arrangement is clearly recognisable as a contract or addendum. Many providers offer the DPA as a separate document to sign.
Do I have to sign the contract? It must be drawn up in writing. An electronic format is sufficient under Art. 28(9), so concluding it by click is common.
