Data Processing Agreements in Ireland: What They Must Say
Last updated 21 October 2026. General information only, not legal advice.
If a supplier handles personal data on your behalf, Article 28 of the GDPR requires a written data processing agreement (DPA) between you. This guide explains when you need one, what it must say under Article 28(3), and how to put one in place. It is written for owners, managers and compliance leads at Irish businesses.
Controller or processor: who needs a DPA?
A controller decides why and how personal data is processed. A processor processes personal data on the controller’s behalf. Whenever a controller engages a processor, the GDPR requires a legally binding contract. The Data Protection Commission (DPC) refers to this as a data processing contract in its guide to controller-processor contracts.
Common processors for Irish businesses include payroll providers, IT support and hosting companies, cloud software and CRM suppliers, email marketing platforms, outsourced customer support and document-shredding or archiving companies. If a supplier only decides how to carry out a task you set, and uses the data for no purpose of its own, it is likely a processor. If it decides its own purposes (for example, a professional adviser using data under its own obligations), it may be a controller in its own right and a different arrangement applies. Where two organisations jointly decide purposes and means, Article 26 (joint controllers) applies instead.
Check each supplier against these roles when you build or update your record of processing activities. Our GDPR guide for small businesses explains the wider obligations.
Is a data processing agreement mandatory?
Yes. Article 28(3) says processing by a processor must be governed by a contract or other legal act binding the processor to the controller. Article 28(9) says it must be in writing, including in electronic form. Article 28(1) also requires you to use only processors that provide sufficient guarantees to implement appropriate technical and organisational measures, so you need to assess the supplier before you sign.
What a DPA must say: Article 28(3)
The contract must set out the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. It must also require the processor to:
- Follow documented instructions from the controller, including on transfers of personal data to a third country or international organisation (Article 28(3)(a)).
- Ensure confidentiality by staff authorised to process the data (Article 28(3)(b)).
- Apply appropriate security measures under Article 32 (Article 28(3)(c)).
- Respect the sub-processor rules in Articles 28(2) and 28(4) (Article 28(3)(d)).
- Help you respond to individuals’ rights requests, such as access requests (Article 28(3)(e)). See our guide to data subject access requests in Ireland.
- Help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36) (Article 28(3)(f)).
- Delete or return all personal data at the end of the services, at your choice, unless law requires storage (Article 28(3)(g)).
- Provide the information needed to demonstrate compliance and allow and contribute to audits and inspections (Article 28(3)(h)). The processor must also tell you immediately if it believes an instruction infringes data protection law.
Sub-processors
A processor must not engage another processor without your prior specific or general written authorisation (Article 28(2)). If you give general authorisation, the processor must tell you about intended changes so you can object. The processor must impose the same data protection obligations on the sub-processor by contract, and it remains fully liable to you if the sub-processor fails to comply (Article 28(4)).
Breaches, transfers and records
Under Article 33(2) a processor must notify the controller without undue delay after becoming aware of a personal data breach. Your DPA should say how and how quickly the processor will tell you, because your own 72-hour deadline to notify the DPC runs from when you become aware. See our 72-hour data breach response guide. If the supplier will transfer data outside the EEA, the DPA should address this, since transfers are only allowed on your documented instructions and need a valid transfer mechanism under Chapter V of the GDPR.
Standard contractual clauses and optional terms
Article 28(6) to (8) allow a DPA to be based on standard contractual clauses. The European Commission adopted standard contractual clauses for controllers and processors under Article 28(7) in Implementing Decision (EU) 2021/915. Using them is optional, but they are a recognised starting point. The DPC’s guidance also notes optional provisions that go beyond the minimum, such as liability terms (including indemnities), more detailed technical security provisions and additional cooperation provisions. These are commercial points to agree between the parties.
Practical steps
- List every supplier that handles personal data for you and decide whether each is a processor.
- Check what is already in place. Many large suppliers publish a standard DPA in their online terms; check it against Article 28(3) rather than assuming it is complete.
- Sign a DPA with each processor that does not have one, and keep copies with your records.
- Review the sub-processor list, security measures and breach notification terms.
- Diarise a periodic review, and update your record of processing activities.
Where a Data Protection Officer is appointed, they can advise on supplier arrangements, though responsibility for having compliant contracts stays with the controller. For the full set of guides, see our GDPR and data protection hub.
Need help with this?
Plus Promotions Limited provides GDPR compliance services for Irish businesses, from €995.
Frequently asked questions
Is a data processing agreement mandatory under GDPR?
Yes. Article 28(3) requires processing by a processor to be governed by a binding contract or other legal act, and Article 28(9) requires it to be in writing, including electronic form.
What must a data processing agreement include?
The subject matter, duration, nature and purpose of the processing, the type of personal data, the categories of data subjects, the controller’s rights and obligations, and the processor commitments listed in Article 28(3)(a) to (h).
What is the difference between a data controller and a data processor?
A controller decides the purposes and means of processing personal data. A processor processes personal data on the controller’s behalf and on its documented instructions.
Can a processor use a sub-processor?
Only with the controller’s prior specific or general written authorisation (Article 28(2)). The processor must pass the same data protection obligations down by contract and remains fully liable to the controller (Article 28(4)).
Who is liable if a processor breaches the GDPR?
Both controllers and processors have direct obligations under the GDPR and can face regulatory action. Contractual liability and indemnity terms between the parties are a commercial matter and are optional in the DPC’s guidance.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
