A Data Processing Agreement is a contract required under GDPR between a data controller and any processor handling personal data on their behalf — if a vendor (hosting provider, analytics tool, form service) processes personal data from your site, you generally need a DPA with them, which your legal counsel should confirm and put in place.
Under GDPR, whenever a third party processes personal data on your behalf as a processor, a Data Processing Agreement setting out their obligations is generally required. This applies to hosting providers, analytics platforms, CRM tools and any vendor touching personal data your site collects.
Whether you need one with a specific vendor, and what it should contain, is a legal question for your counsel and data protection officer. Most major platforms (Google, hosting providers, CRM vendors) offer a standard DPA you can review and execute.
We build to whatever data handling requirements your DPO specifies and can support the technical documentation a DPA process needs — see GDPR and consent for the broader technical implementation.
Yes, where we process personal data on your behalf as part of the engagement, signing a data processing agreement is a standard part of onboarding rather than an exception. It sets out how data is handled, secured, and returned or deleted at the end of the relationship, and your legal team should review its terms before signing.
Generally yes, for any vendor or tool that processes personal data on your behalf, though the exact list depends on what each tool touches. Analytics, CRM, and hosting providers typically need one; a tool that never handles personal data usually does not. Your legal counsel can confirm the specific list for your organisation.
Not automatically — data transfers outside the EU are permitted under specific legal mechanisms, though the requirements differ by destination and data type. See does pharma data have to stay in the EU for how that applies to a pharma website specifically, and what to confirm with legal counsel first.
A properly drafted DPA specifies this upfront, typically requiring the processor to return or securely delete all personal data at the end of the engagement, with confirmation provided in writing. Check this clause specifically before signing, since its absence or vagueness is one of the more common gaps found during later compliance review.
Tell us your data flows and we will support whatever your legal team needs technically.