Data processing agreements without dread
Two companies, one set of personal data, and a contract that says who decides what.
By Tomas Berglund, 4 Dec 2025. 5 minute read. Data and privacy. Fictional author and date.
A looks heavy because it is long. Its idea is short: when one company handles personal data on behalf of another, they write down who decides what is done with it.
Start by naming the roles. The company that decides why and how data is used is the . The company that handles it on instruction is the . Most software suppliers are processors for their customers’ data.
“Write down who decides what is done with the data.”
Then check five things: what data, for what purpose, how long, which sub-suppliers, and what happens at the end of the contract. If you can say each in one line, you understand your agreement.
Draw the data map before negotiating. It is much easier to agree a contract that describes what really happens.
What this does not cover. This article does not cover international transfers or any one country’s rules. It is not advice.
Terms used in this article
- Data processing agreement. A contract in which a company handling personal data for another promises to follow its instructions and protect the data.
- Controller. The organisation that decides why and how personal data is used.
- Processor. An organisation that handles personal data on behalf of a controller and on its instructions.