--- title: "What Is a Data Processing Agreement? DPA under GDPR for Germany (2026)" description: "What is a data processing agreement (DPA) under GDPR? Article 28 requirements, when a DPA is mandatory in Germany, and which AI tools provide one." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/compliance/data-processing-agreement/" language: "en" --- ![Data processing agreement DPA Article 28 GDPR Germany AI tools](https://compound.law/assets/images/compliance/compliance_2.webp) Guides # What Is a Data Processing Agreement? DPA under GDPR for Germany (2026) 8 April 2026 What is a Data Processing Agreement (DPA)? A DPA (Auftragsverarbeitungsvertrag/AVV) is a mandatory contract under Article 28 GDPR, required when a company engages an external provider to process personal data. It defines data scope, purpose, security measures, and processor obligations. - A DPA is legally required under Article 28 GDPR for every controller-processor relationship involving personal data. - The DPA must cover the subject matter, duration, nature, purpose, data categories, and all processor obligations. - Processing personal data via an external provider without a valid DPA is unlawful — fines up to EUR 10 million or 2% of global turnover. A **data processing agreement (DPA)** — known in Germany as **Auftragsverarbeitungsvertrag (AVV)** — is a legally binding written contract required by **Article 28 GDPR** whenever a company engages an external service provider to process personal data on its behalf. The DPA establishes what data may be processed, for what purpose, under which security conditions, and how the service provider must act on the company’s instructions. Without a valid DPA in place, any transfer of personal data to that provider is unlawful under GDPR — regardless of whether the provider is a cloud platform, an AI tool, or a traditional IT service. ## What Is a Data Processing Agreement (DPA) under GDPR? A DPA is the contractual cornerstone of every **controller-processor relationship** under GDPR. The company that determines why and how personal data is processed is the **controller** (Verantwortlicher in German). The external service provider that processes data on the controller’s behalf is the **processor** (Auftragsverarbeiter). The key legal principle is **instruction-bound processing**: the processor may only act on documented instructions from the controller and must not use the data for its own purposes. This is what distinguishes a data processor from an independent data controller. For German companies, this matters across the entire technology stack. Every SaaS tool, cloud platform, and AI service that touches personal data — customer names, email addresses, employee records, user behavior — requires a DPA before use. The DPA gives you contractual control over how that data is handled and ensures the provider is legally accountable. ## When Is a DPA Legally Required in Germany? A DPA is required whenever **three conditions** are met simultaneously: 1. An **external party** (not an internal employee) processes personal data 2. The processing is performed **on behalf of and under instruction from** your company 3. The data concerns **natural persons** (customers, employees, users, applicants, etc.) In practice, this covers nearly every business software tool in use today. Email marketing platforms, CRM systems, HR tools, cloud storage providers, and AI assistants all process personal data — and therefore require a DPA before deployment. **A DPA is not required** when: - Only genuinely anonymized or aggregated data is transferred, with no means to re-identify individuals - The service provider processes data for **its own independent purposes** (this would constitute joint controllership under Article 26 GDPR or independent processing, not a processor relationship) - Processing is carried out by internal employees acting within the scope of their employment The boundary can be particularly complex with **AI tools**. If a provider uses your input data to train or improve its models, that may constitute independent processing rather than instruction-bound processing — in which case a DPA alone is insufficient, and a separate legal basis under Article 6 GDPR is required. ## What Must a DPA Contain? (Article 28 GDPR Requirements) Article 28(3) GDPR prescribes the mandatory content of every DPA. The contract must cover: **Processing subject matter:** - **Subject matter** of processing (e.g., storage of customer contact data, analysis of communication content) - **Duration** of processing (contract term, deletion timelines after contract end) - **Nature and purpose** of processing (specific activities and permitted use cases) - **Type of personal data** (e.g., names, email addresses, payment data, IP addresses) - **Categories of data subjects** (e.g., customers, employees, website visitors) **Processor obligations (Article 28(3)(a)–(h) GDPR):** - **Confidentiality:** Only authorized personnel subject to written confidentiality obligations may access the data - **Technical and organizational measures (TOMs):** Security appropriate to the risk under Article 32 GDPR, including encryption, access controls, availability, and integrity - **Subprocessors:** New sub-processors only with prior written consent from the controller; the main processor remains fully liable - **Data subject rights:** Assistance with access, deletion, rectification, and portability requests - **Breach notification:** Immediate notification of the controller in the event of a personal data breach - **Deletion or return:** All data must be returned or securely deleted after contract termination - **Audit rights:** The controller must be able to conduct audits, inspections, and reviews A DPA missing any of these elements is incomplete and creates compliance risk — even if the vendor provides a standard template. ## DPA and AI Tools: What German Companies Need to Check Using **AI software in a German business context** raises specific questions beyond the standard DPA checklist. ### Processing Purpose and Instruction-Bound Processing The AI provider must not use your data to train its models without your explicit consent — and even with consent, that may cross the line from processing into independent use. Review the vendor terms carefully: - Can the provider use input data or conversation history for model training? - Is there an option to disable training on your data (typically available in enterprise tiers)? - Is the processing purpose clearly limited to operating the service? ### International Data Transfers (Standard Contractual Clauses) Most AI providers are based in the United States or other third countries outside the European Economic Area (EEA). Transferring personal data to these providers requires an additional legal instrument. The standard mechanism is **Standard Contractual Clauses (SCCs)** under Article 46(2)(c) GDPR, which must be incorporated into or attached to the DPA. Check whether: - SCCs are included in the DPA or signed as a separate addendum - The provider has conducted a **Transfer Impact Assessment (TIA)** evaluating the specific risks of the transfer - The provider offers EU data residency options to minimize international transfers ### Subprocessors and Sub-DPA Chains Complex SaaS services typically rely on their own subprocessors for hosting, analytics, support infrastructure, and content delivery. Each subprocessor that can access your data must be listed in the provider’s subprocessor list. Your DPA should ensure that: - You are notified of new subprocessors before they are added (with a right to object) - Subprocessors are bound by the same data protection obligations as the main processor - The main processor’s liability is not limited in the event of a subprocessor breach ## AI Tools That Provide a DPA: Quick Comparison The following table covers widely used AI tools and SaaS services. Each linked page contains a detailed review of the specific DPA for German deployments. | Tool | DPA Available | Detailed Review | | -------------------------------------------------------------------------- | :-----------: | ----------------------------------------------------------------- | | [Claude Enterprise](https://compound.law/en-DE/tools/claude-enterprise/) | Yes | [Claude DPA review](https://compound.law/en-DE/tools/claude-dpa/) | | [ChatGPT Enterprise](https://compound.law/en-DE/tools/chatgpt-enterprise/) | Yes | Detail page | | [OpenAI API](https://compound.law/en-DE/tools/openai-api/) | Yes | Detail page | | [Cursor](https://compound.law/en-DE/tools/cursor/) | Yes | Detail page | | [Notion AI](https://compound.law/en-DE/tools/notion-ai/) | Yes | Detail page | | [ElevenLabs](https://compound.law/en-DE/tools/elevenlabs/) | Yes | Detail page | | [Canva AI](https://compound.law/en-DE/tools/canva-ai/) | Yes | Detail page | | [Grammarly](https://compound.law/en-DE/tools/grammarly/) | Yes | Detail page | | [HubSpot](https://compound.law/en-DE/tools/hubspot/) | Yes | Detail page | | [Whisper](https://compound.law/en-DE/tools/whisper/) | Yes | Detail page | | [Zapier](https://compound.law/en-DE/tools/zapier/) | Yes | Detail page | | [Slack](https://compound.law/en-DE/tools/slack/) | Yes | Detail page | | [Make.com](https://compound.law/en-DE/tools/make/) | Yes | Detail page | | [Zendesk](https://compound.law/en-DE/tools/zendesk/) | Yes | Detail page | | [Perplexity](https://compound.law/en-DE/tools/perplexity/) | Yes | Detail page | | [Descript](https://compound.law/en-DE/tools/descript/) | Yes | Detail page | | [Figma AI](https://compound.law/en-DE/tools/figma-ai/) | Yes | Detail page | | [DeepL](https://compound.law/en-DE/compliance/gdpr-ai-procurement/) | Yes | Detail page | | [Intercom](https://compound.law/en-DE/tools/intercom/) | Yes | Detail page | | [AWS Bedrock](https://compound.law/en-DE/tools/aws-bedrock/) | Yes | Detail page | | [Airtable](https://compound.law/en-DE/tools/airtable-ai/) | Yes | Detail page | | [Asana](https://compound.law/en-DE/tools/asana-ai/) | Yes | Detail page | > **Note:** Whether a vendor’s DPA is sufficient for your specific deployment depends on your data flows, data categories, and internal compliance requirements. This overview does not replace individual legal review. ## What If a Vendor Refuses to Sign a DPA? Some providers — particularly smaller or non-European services — decline to provide a DPA. Your options in this situation: **1. Stop using the service.** If a tool processes personal data and no DPA can be agreed, using it is unlawful under GDPR. Ceasing use is the legally sound response. **2. Find a compliant alternative.** European vendors or privacy-forward providers often offer full DPAs and EU data residency. Switching eliminates the compliance gap. **3. Minimize data exposure.** If a tool is operationally critical, assess whether the data flow can be redesigned so that no personal data is transmitted — for example, by pseudonymizing data before input. **4. Individual legal assessment.** In exceptional cases, it may be possible to rely on individual consent from each affected data subject as the legal basis. This is operationally complex and rarely scalable. Hoping that no supervisory authority will notice is not a compliance strategy. German data protection authorities — including the **Bavarian State Office for Data Protection Supervision (BayLDA)**, the **Berlin Commissioner for Data Protection**, and the **Hamburg DPA** — actively audit and enforce GDPR obligations. ## DPA Compliance Checklist Before Deploying a New Tool Before putting a new service into production that processes personal data: - [ ] DPA received from the vendor? - [ ] All Article 28(3) GDPR mandatory elements present? - [ ] Processing purpose clearly defined and limited to service operation? - [ ] Standard Contractual Clauses or alternative transfer instrument for data flows outside the EEA? - [ ] Subprocessor list reviewed and accepted? - [ ] DPA documented in your Article 30 GDPR Records of Processing Activities? - [ ] Technical and organizational measures (TOMs) described and adequate? - [ ] Data breach notification procedure in place? - [ ] Data deletion or return procedure agreed for contract termination? ## How Compound Law Can Help Compound Law reviews DPAs in the context of your specific deployment — not just whether a DPA formally exists, but whether it covers your actual data flows, employee or customer data categories, and internal compliance requirements. Typical services: - **DPA review:** Completeness check, international transfer analysis, subprocessor chain assessment - **DPA template:** Drafting a tailored agreement for your own processor relationships - **Article 30 Records:** Documentation of all processing activities in your records of processing - **GDPR advisory:** Overview of all GDPR obligations relevant to your business Get in touch to find out whether your AI tools and SaaS services are properly covered under GDPR. ## Frequently Asked Questions ### What is a data processing agreement in simple terms? A data processing agreement is a written contract required by GDPR that defines the rules under which an external service provider may process personal data on your behalf. It covers what data may be processed, for what purpose, with what security measures, and what happens to the data after the contract ends. ### Does a verbal DPA satisfy GDPR requirements? No. Article 28(9) GDPR requires the agreement to be in writing, including in electronic form. A verbal agreement is not legally effective and does not satisfy the GDPR requirement. ### What is the difference between a DPA and Standard Contractual Clauses? A DPA governs the controller-processor relationship under Article 28 GDPR and applies to all processing of personal data by the provider. Standard Contractual Clauses (SCCs) are a separate mechanism under Article 46 GDPR used specifically to legitimize data transfers to countries outside the EEA. Many DPAs include SCCs as an addendum for international transfer scenarios. ### Do free SaaS tools require a DPA? Yes, if the tool processes personal data. GDPR does not distinguish between paid and free services — the obligation arises from the nature of the data processing, not the price. However, many free tools do not offer a DPA, which makes their use with personal data legally problematic. ### How long should I retain a signed DPA? You should retain the DPA for at least the duration of the provider relationship and for the applicable limitation period after contract termination — typically three to five years under German law. ### What is the German term for a data processing agreement? The German term is **Auftragsverarbeitungsvertrag**, commonly abbreviated as **AVV**. The concept is identical to the DPA under GDPR. German companies often use both terms interchangeably when communicating with domestic providers. ## Related Compliance Guides [![GDPR-compliant AI implementation for businesses in Germany](https://compound.law/assets/images/compliance/compliance_1.webp)](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [Guides](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) ### [GDPR-Compliant AI in Germany: A Practical Guide for 2026](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [GDPR-compliant AI means a lawful basis, transparency, a DPA, controlled transfers and a DPIA where risk is high. The 2026 guide for German companies.](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [![AI legal counsel in Germany for company AI procurement](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [Guides](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) ### [AI Legal Counsel in Germany for Companies](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [AI legal counsel in Germany helps companies handle EU AI Act, GDPR, DPA, procurement, and rollout risk before signing or launching AI tools.](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [![EU AI Act procurement before 2027 for German buyers](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [compliance](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ### [EU AI Act Procurement Before 2027 in Germany](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [EU AI Act procurement before 2027 matters now for German buyers because contracts, evidence flows, and deployer support should be fixed before rollout.](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ## Frequently asked questions A DPA is required whenever an external service provider processes personal data on behalf of and under instruction from a company. This applies to SaaS tools, cloud services, IT providers, AI applications, and marketing platforms that access customer, employee, or user data. Article 28(3) GDPR requires the DPA to specify subject matter, duration, nature and purpose of processing, data types, data subject categories, and controller rights. The processor must commit to confidentiality, security, subprocessor management, data subject rights support, breach notification, and data deletion after contract end. No. Article 28(9) GDPR expressly requires the contract to be in writing, including in electronic form. A verbal DPA has no legal effect under GDPR. Processing personal data through an external provider without a valid DPA is unlawful under GDPR. Supervisory authorities can impose fines of up to 10 million euros or 2% of worldwide annual turnover, and affected individuals may claim damages under Article 82 GDPR. Yes, if the SaaS provider processes personal data of your customers, employees, or users on your behalf. This covers CRM systems, email marketing platforms, cloud storage, HR software, AI assistants, and most business applications. Most major commercial AI providers offer a DPA for their enterprise products and APIs. Anthropic, OpenAI, Google, and Microsoft each provide DPAs including Standard Contractual Clauses for international data transfers. Whether a specific DPA is sufficient for your deployment requires individual review of your data flows and use case. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "What Is a Data Processing Agreement? DPA under GDPR for Germany (2026)", "description": "What is a data processing agreement (DPA) under GDPR? Article 28 requirements, when a DPA is mandatory in Germany, and which AI tools provide one.", "image": "https://compound.law/assets/images/compliance/compliance_2.webp", "datePublished": "2026-04-08T00:00:00.000Z", "dateModified": "2026-04-08T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/compliance/data-processing-agreement/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "Compliance Guides", "item": "https://compound.law/en-DE/compliance/" }, { "@type": "ListItem", "position": 3, "name": "What Is a Data Processing Agreement? DPA under GDPR for Germany", "item": "https://compound.law/en-DE/compliance/data-processing-agreement/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "When is a data processing agreement required under GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "A DPA is required whenever an external service provider processes personal data on behalf of and under instruction from a company. This applies to SaaS tools, cloud services, IT providers, AI applications, and marketing platforms that access customer, employee, or user data." } }, { "@type": "Question", "name": "What must a data processing agreement contain under Article 28 GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "Article 28(3) GDPR requires the DPA to specify subject matter, duration, nature and purpose of processing, data types, data subject categories, and controller rights. The processor must commit to confidentiality, security, subprocessor management, data subject rights support, breach notification, and data deletion after contract end." } }, { "@type": "Question", "name": "Does a verbal data processing agreement comply with GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "No. Article 28(9) GDPR expressly requires the contract to be in writing, including in electronic form. A verbal DPA has no legal effect under GDPR." } }, { "@type": "Question", "name": "What happens if a company processes data without a DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Processing personal data through an external provider without a valid DPA is unlawful under GDPR. Supervisory authorities can impose fines of up to 10 million euros or 2% of worldwide annual turnover, and affected individuals may claim damages under Article 82 GDPR." } }, { "@type": "Question", "name": "Do I need a DPA with every SaaS provider I use?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, if the SaaS provider processes personal data of your customers, employees, or users on your behalf. This covers CRM systems, email marketing platforms, cloud storage, HR software, AI assistants, and most business applications." } }, { "@type": "Question", "name": "Do AI tools like Claude Enterprise or ChatGPT Enterprise provide a DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Most major commercial AI providers offer a DPA for their enterprise products and APIs. Anthropic, OpenAI, Google, and Microsoft each provide DPAs including Standard Contractual Clauses for international data transfers. Whether a specific DPA is sufficient for your deployment requires individual review of your data flows and use case." } } ] } ] ```