Skip to content

The DPA: The Document That Unblocks Deals

The first time most small suppliers hear the term DPA, it's from a customer's procurement team explaining that the contract can't proceed without one. The Data Processing Agreement is the most commonly missing legal document in B2B, and it costs more stalled deals than any certificate you could name.

What a DPA is

Under GDPR Article 28, whenever a business processes personal data on behalf of another business — the customer is the controller, you're the processor — the relationship must be governed by a written contract containing specific clauses. That contract is the DPA.

The trigger is broader than people expect. Running a customer's mailing list, hosting their data, processing their payroll, handling their support tickets, storing their client records: all of it is processing on behalf, all of it requires a DPA. A nine-person agency that hosts a customer's CRM data needs one exactly like a multinational cloud provider.

What it must contain

Article 28 lists the mandatory contents: the subject matter and duration of processing, the nature and purpose, the types of personal data and data subjects, your obligations as processor (confidentiality, security, sub-processor rules, breach notification, deletion at end of contract), and the customer's rights to audit and instruct.

The sub-processor clause trips most small firms. If you use any third-party tools to handle the data — a hosting provider, an analytics service, a subcontractor — they're sub-processors, and the DPA must authorise them and keep the list current. A stale list is a breach waiting to be found.

What happens without one

Three consequences, in escalating order:

  1. The deal stalls. A customer that cares about GDPR compliance cannot lawfully work with you without a DPA — the obligation is on them, so they'll walk or wait.
  2. Liability without boundaries. Without Article 28 terms, the division of responsibility between controller and processor is undefined, which is exactly how both sides end up blamed.
  3. Regulator exposure. Processor obligations are directly enforceable, with fines under GDPR up to €10 million or 2% of global turnover. Missing paperwork is the easiest finding an authority can make.

We covered the data protection foundation in the GDPR software guide and the manufacturer angle in the practical GDPR guide.

Why it should be a living page

A DPA that sits as a Word file in a sales folder gets signed in version 1.2 while 1.5 floats around somewhere else. The SaaS world solved this with trust centers: the DPA lives at a permanent URL, always current, and the buyer reads it before the first call. When your sub-processor list changes, you update the page once and every deal that links to it sees the current version. That's the Trust Hex approach applied to the contract layer.

How Sustalium Helps with DPAs

  • A living, dated DPA page — permanent URL, current sub-processor list, updated in place.
  • Part of your Trust Hex — the DPA sits beside your GDPR record and security posture where buyers already look.
  • One link in every contract — paste the address into proposals and signatures stay aligned with the current version.

The Deal Waits on the DPA. Don't Make It Wait Long.

Publish yours as a living page and unblock every procurement conversation at once. Start with a free draft: no card needed, publish the verifiable version when you are ready.

See Our GDPR & DPA, Hosted the Same Way →

Frequently Asked Questions

Do I need a DPA if I'm a product company?

Only if you process personal data on behalf of customers — connected products, hosted services, warranty programs. Most manufacturers discover they do.

Who writes it?

Your customer's DPA often exists; you negotiate and sign. Having your own template ready — reviewed by a privacy lawyer — makes the negotiation an afternoon instead of a quarter.

How often does it change?

Whenever your sub-processors, services or data flows change. That's why the living page matters: the list inside must match reality.

Last updated: September 30, 2026

Global Digital Trust & Compliance

Sustalium is the digital-first platform for managing complex business certificates and sustainability declarations across global supply chains.

Environment & ESG
  • Digital Product Passport (DPP)
  • Carbon & Water Footprint
  • Circularity & Reuse (ISO 14021)
  • De-Forestation Free
Product & Food Safety
  • FSMA 204 (FDA Traceability)
  • REACH & RoHS Compliance
  • PFAS-Free & VOC Declarations
  • Prop 65 & TSCA Title VI
Social & Ethical
  • ISO 26000 Responsibility
  • Modern Slavery Statements
  • UFLPA Forced Labor Traceability
  • Ethical Labor Declarations
Governance & Trade
  • Swiss Made & Origin Claims
  • GDPR & AI Ethics (EU AI Act)
  • CE Marking & UKCA Conformity
  • Bill S-211 (Canada) Reporting
Start Free

Have questions about a specific standard?
Contact our compliance team at compliance@sustalium.com