Do I need a data processing agreement with every supplier in Ireland?
Last updated November 2026. General information only, not legal advice.
No. You need a data processing agreement with suppliers who process personal data on your behalf and on your instructions, because they are “processors” under Article 28 GDPR. You do not need one with suppliers who never touch personal data, or who decide for themselves how and why they use it (separate controllers).
When a data processing agreement with suppliers is required
A processor is a body that processes personal data on behalf of a controller (Article 4(8)). Article 28(3) requires a written contract with every processor; the EDPB’s Guidelines 07/2020 say having none is itself an infringement by both parties.
Typical processors: payroll bureaus, outsourced HR, cloud hosting and SaaS tools, email marketing platforms, IT support with system access. Suppliers who process nothing personal, such as a stationery supplier or electricity provider, fall outside Article 28.
The third group is suppliers who are controllers in their own right. The EDPB’s examples include a bank handling payroll transfers, an accountancy firm carrying out an audit, and a law firm representing a client: each decides its own purposes and means. The EDPB adds that this can change if you give a firm very detailed instructions and no professional or legal obligation shapes its work, so a bookkeeper working purely to your instructions may be a processor. Decide unclear cases on the facts and record why.
What an Article 28 contract must contain, and the vetting duty
The contract must state the subject matter, duration, nature and purpose of the processing, the types of personal data, the categories of data subjects and your obligations and rights. It must oblige the processor to:
- act only on your documented instructions, including on international transfers
- bind its staff to confidentiality
- apply the security measures required by Article 32
- engage sub-processors only with your prior written authorisation, on the same terms
- help with data subject requests, security, breaches and impact assessments
- delete or return the data at the end of the service, at your choice
- show compliance on request and allow audits
The EDPB warns that a contract should not merely restate the GDPR: it should say what the security measures actually are.
Separately, Article 28(1) lets you use only processors providing “sufficient guarantees” of appropriate technical and organisational measures. The EDPB treats this as a continuous duty: check expertise, reliability and resources before signing, and re-check at intervals. That is supplier GDPR due diligence in Ireland in practice, and the Supplier Data Protection Due Diligence Pack template gives you a questionnaire and record for it. It is self-complete; it cannot judge a specific supplier’s security for you or negotiate terms.
Overseas suppliers and the big platforms
Most SaaS providers hand you their own data processing terms and will not negotiate. The EDPB says that is acceptable if the terms meet Article 28(3) and changes are notified to you directly; a weak bargaining position is no excuse for non-compliant clauses.
If a supplier processes data outside the EEA, Chapter V also applies. Adequacy decisions (including the UK) make transfers straightforward. Certified US companies can rely on the EU-US Data Privacy Framework, which remains in force: the General Court dismissed the Latombe challenge on 3 September 2025 (T-553/23), but an appeal (C-703/25 P) is pending, and on 31 July 2026 the EDPB asked the Commission to assess whether the US Supreme Court’s Trump v. Slaughter ruling on FTC independence affects it. Many businesses sign the Commission’s transfer standard contractual clauses as a fallback, which require a transfer impact assessment (Clause 14).
For high-risk processing, negotiated liability terms or multi-country transfer assessments, a template is not enough: find a solicitor through the Law Society. Our guide to data processing agreements in Ireland under GDPR Article 28 covers the wider picture.
Frequently asked questions
Which suppliers need a DPA?
Any supplier processing personal data on your behalf and instructions: payroll bureaus, cloud and SaaS providers, email marketing platforms, IT support with system access, outsourced HR. Suppliers that never handle personal data, or use it for their own purposes as separate controllers, do not.
What are the Article 28 contract requirements?
A written contract setting out the subject matter, duration, nature, purpose, data types, data subject categories and your rights, plus processor obligations on instructions, confidentiality, security, sub-processors, assistance, deletion or return of data, and audits.
Do I need a controller to controller agreement under GDPR?
Article 28 does not require one between independent controllers such as you and your accountant or solicitor; each is responsible for its own compliance. A data sharing agreement is still useful to record what is shared and why.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. For advice on your own situation, speak to a solicitor.
Sources: DPC Practical Guide to Controller-Processor Contracts, EDPB Guidelines 07/2020, GDPR (EUR-Lex), Commission adequacy decisions, EDPB letter of 31 July 2026
