Article 28 DPA template: how to put a processor agreement in place

8 min read · Updated 2026-11-12

Whenever a vendor processes personal data on your documented instructions, that vendor is a processor and you need a data processing agreement under Article 28 of the GDPR. In Dutch this is a verwerkersovereenkomst. A template is a starting point, not a finished contract, until the parties, the scope and the instructions are filled in and signed.

When Article 28 applies

If a tool, host, email provider or support desk processes personal data for you, and it is not acting as an independent controller, you are the controller and they are the processor (or a further processor). Article 28 says the processing must be governed by a contract or other legal act. The same is true in the other direction: if you process personal data for a business customer, you are their processor and they will ask you for an agreement.

A privacy notice is not a substitute. A terms-of-service clause that only says 'we comply with the GDPR' is not a substitute. The agreement has to contain the specific elements in Article 28(3).

What the agreement must cover

Article 28(3) requires, at least: the subject matter, duration, nature and purpose of the processing; the type of personal data and categories of data subjects; the obligations and rights of the controller; and terms that bind the processor to: process only on documented instructions, ensure confidentiality, take appropriate security measures (Article 32), respect the rules on other processors, help you with data subject rights and with Articles 32 to 36, delete or return data at the end, and make information available for audits.

If personal data goes outside the EEA, you also need a transfer tool under Articles 44 to 49, such as an adequacy decision (including the EU-US Data Privacy Framework where it applies) or Standard Contractual Clauses plus a transfer assessment. That is separate from, and in addition to, the Article 28 contract.

How to use a template well

Fill in the real vendors, the real categories of data, and the real instructions. List sub-processors and how you will be notified of changes. Say where data is stored. Do not sign a document that still contains placeholders. Keep the signed copy with the audit trail (who signed, when, and the document hash).

DPOne generates an Article 28 agreement from your onboarding answers and lets both sides sign in the platform with an eIDAS simple electronic signature. The public page shows the standard template. Your signed version is the one that counts for your account.

Frequently asked questions

Do I need an Article 28 agreement with Google, Stripe or my host?

If they process personal data on your instructions, yes. Large providers usually offer their own data processing addendum. You still have to review it, accept it, and record the sub-processors and transfer tool.

Is a template enough for a customer due-diligence request?

A blank template is not. A signed agreement that matches the actual processing, plus a current sub-processor list, is what a serious buyer or customer will look for.