DPAs for a US SaaS company with EU customers

Why this document exists

Under the GDPR, a company that processes personal data on behalf of another must do so under a written contract containing a specific list of terms. Those terms are set out in Article 28 of the regulation. A data processing agreement is the document that contains them. If you are a US software company with a customer in the EU whose employees or end users appear in your system, you are a processor, the customer is the controller, and Article 28 applies to you.

The UK has retained a near-identical regime after Brexit, with its own version of the transfer safeguards.

What has to be in it

The Article 28 list is non-negotiable in the sense that a compliant DPA has to cover each item. How each item is drafted is very negotiable. The mandatory content includes:

• Processing only on documented instructions from the controller.
• Confidentiality commitments from personnel.
• Security measures appropriate to the risk (Article 32).
• Sub-processor rules: prior authorisation, flow-down of obligations, liability for sub-processors.
• Assistance to the controller with data subject requests and with its own compliance obligations, including breach notification and impact assessments.
• Deletion or return of data at the end of the relationship.
• Audit rights, including making available information needed to demonstrate compliance.

Transfers: the part US vendors get wrong

Personal data leaving the EU for the US needs a lawful transfer mechanism. There are three routes in common use. The EU–US Data Privacy Framework, for certified US companies. The Standard Contractual Clauses adopted by the European Commission in 2021, in the module that fits the relationship (usually controller-to-processor, module two). And, for UK data, the UK International Data Transfer Addendum layered onto the SCCs, or the UK’s own agreement.

Two practical points. First, the SCCs must be used as published — the operative clauses cannot be edited, though the annexes describing the processing, the security measures and the parties are yours to complete. Second, the SCCs come with an obligation to assess whether the destination country’s laws undermine the protections; sophisticated customers will ask to see that assessment. Have one.

The clauses customers push on

Sub-processors

Every SaaS vendor uses sub-processors: cloud infrastructure, email delivery, analytics, support tooling. The regulation requires the controller’s authorisation. Vendors want general authorisation with a published list and a notice period for changes. Customers sometimes ask for specific prior approval of each one, which is operationally impossible at scale. The standard compromise: general authorisation, a public sub-processor list, thirty days’ notice of additions, and a right to object — with termination as the customer’s remedy if the objection cannot be resolved.

Audit rights

Customers ask for on-site audits at will. Vendors cannot run a business with a hundred customers each auditing annually. The usual landing: audit rights satisfied by a current third-party report (SOC 2 Type II or ISO 27001 certification), with on-site audit reserved for cases where the report is insufficient or a breach has occurred, at reasonable notice and the customer’s cost.

Breach notification timing

Controllers must notify their supervisory authority within 72 hours of becoming aware of a breach. They therefore want processors to notify them fast — sometimes “immediately” or within 24 hours. Commit to what you can operationally deliver; a promise of 24 hours you cannot keep is worse than a 48-hour commitment you can. “Without undue delay and in any event within 48 hours of confirming a personal data breach” is a defensible position.

Liability

Customers often ask for the DPA to sit outside the main agreement’s liability cap. See our guide to the MSA for why that is the single most consequential ask in the whole negotiation, and why a higher but finite “super cap” for data incidents is the normal resolution.

US state law

California and a growing list of other states now require service-provider or processor contracts with their own mandatory terms. They overlap heavily with Article 28 but are not identical — California, for instance, has specific language about the sale and sharing of personal information. A well-drafted DPA addresses both regimes in one document rather than attaching separate US and EU versions that contradict each other.