Published by STRUB.LAW

Berlin Online Glossary

of German Business Law

Painting: Reiner Strub Painting: Reiner Strub Painting: Reiner Strub Painting: Reiner Strub Painting: Reiner Strub
© Nachlass Reiner Strub
Back to the overview

General · Compliance & regulatory

Data processing agreement, DPA (Auftragsverarbeitungsvertrag, AVV)

contract required by the General Data Protection Regulation (GDPR) when a service provider processes personal data on behalf of and on the instructions of a business. This may apply, for example, to hosting, AI service providers, cloud software, newsletter distribution or an external payroll provider. The mandatory content is prescribed by law.

In practice

A business that receives personal data is responsible for ensuring that it is used and processed lawfully. Processing personal data requires a legal basis. If an external service provider processes the data on behalf of and on the instructions of the business, a data processing agreement (DPA) is also required. In practice, large providers (e.g. Microsoft 365, Google Workspace, IONOS) supply commercial general terms and conditions that include a DPA. Even so, the business must check this and should keep a record of it. Tax advisers and lawyers, when advising independently, generally process data as controllers in their own right. No DPA is needed for that work.

Term 11 of 44 · As at 9 September 2026

Sources

Licence: CC BY 4.0*

How to cite: Data processing agreement, DPA (Auftragsverarbeitungsvertrag, AVV), in: Berlin Online Glossary of German Business Law, published by STRUB.LAW, as at 9 September 2026, https://strub.law/en/glossary/data-processing-agreement-dpa/, CC BY 4.0

*This licence applies only to the written entries of the Berlin Online Glossary.

The entries are carefully researched and reflect the position as at the date stated in each entry. They provide an initial overview and are no substitute for legal advice on your specific case. I cannot guarantee that they are accurate, complete or up to date. I am happy to discuss with you which rule applies to your situation. Have you spotted a mistake or do you have a comment? I would be glad to hear from you at info@strub.law.