Processing Agreement

Legal Framework

A processing agreement under GDPR binds a controller and processor to specific terms governing the processing of personal data. Where the processor is located outside the EEA, the agreement must incorporate appropriate safeguards for international transfers under Article 46 GDPR. Article 46(2)(c) recognizes Commission-adopted standard contractual clauses as a valid safeguard:

"standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2)"
— GDPR Art. 46(2)(c)

Recital 109 clarifies that SCCs may be embedded within broader contractual frameworks:

"Controllers and processors should be encouraged to provide additional safeguards via contractual commitments that supplement standard protection clauses."
— GDPR Recital 109

Supervisory authorities retain broad corrective powers under Article 58 GDPR to address failures in processing agreements, including ordering compliance within specified periods.

Key Developments

Enforcement actions confirm that the absence of a valid processing agreement constitutes a standalone infringement. The Croatian DPA (AZOP) fined a hospital €190,000 partly for failing to enter into a data processing agreement. The Irish DPC, in the Midlands Regional Hospital investigation, rejected the notion that a service level agreement and confidentiality agreement sufficed:

Dutch courts have addressed whether a processing agreement was actually concluded. In a case involving ActiveCampaign, the claimant argued the AP should have enforced against both the absence of a valid processing agreement and missing SCCs. The Rechtbank held that formation of an agreement is a civil law question extending beyond mere signatures:

"de totstandkoming van een overeenkomst een civielrechtelijke vraag is, die meer omvat dan alleen of er handtekeningen zijn gezet"
— Rechtbank, §3.15

The court upheld the AP's decision to close the case where signed agreements and SCCs existed, noting the AP's prioritization policy could justify not pursuing further investigation.

Status of the Debate

This topic is contested in court. Courts have diverged on whether the existence of a signed document suffices to demonstrate a valid processing agreement or whether full civil law formation requirements must be assessed. The Dutch ruling that agreement formation involves more than signatures—and that supervisory authorities may exercise discretion to deprioritize enforcement—leaves the practical threshold unclear. No court split is on record yet, but a ruling clarifying what evidentiary standard applies to processing agreement formation under Article 28 would resolve the open question.

Practical Guidance

• Execute written processing agreements before any processing begins; service level agreements or confidentiality provisions alone do not satisfy Article 28 requirements.
• Where the processor transfers data outside the EEA, incorporate approved SCCs and ensure both parties have signed them before the transfer occurs.
• Do not rely on a processor's general GDPR compliance posture to cover your controller obligations; the DPC has explicitly rejected this argument.
• Document the full contractual formation process, not just signatures, given that courts treat agreement formation as a civil law question involving more than execution.
• Where agreements are missing or incomplete, document remediation promptly; supervisory authorities apply prioritization criteria and may exercise discretion not to pursue enforcement.