Buyer Guides · 6 MIN
GDPR DPA checklist for hiring developers or a software agency
A 14-point checklist for the GDPR Article 28 data processing agreement when you hire developers: roles, sub-processors, breach notice, transfers, audits and exit.
A GDPR data processing agreement (DPA) with a software vendor must cover the terms in Article 28(3): documented instructions, confidentiality, security, sub-processors, help with data subject rights and incidents, deletion or return, and audits. If the vendor sits outside the EU, add a transfer mechanism such as the Standard Contractual Clauses. This checklist turns those into questions you can tick.
- A DPA is required whenever a vendor processes personal data on your behalf, even briefly, such as support access to a database.
- Article 28(3) lists the mandatory terms, and a contract that omits any of them is noncompliant.
- The vendor must tell you about a personal data breach without undue delay, so set an hours-based deadline.
- Controllers and processors can both be liable to individuals, and the controller can be fined for hiring a processor without adequate guarantees.
- Vendors outside the EU and EEA need a Chapter V transfer tool, and India has no adequacy decision.
- Nactore is an AI-native technology and growth company in Mumbai that works from your DPA, names its sub-processors and keeps access logs.
When do you need a DPA with a developer?
You need one whenever the developer processes personal data for you. Processing includes viewing, copying, storing or deleting. A single engineer debugging a production database counts. A team building on synthetic data may not. The text of Article 28 says the processing "shall be governed by a contract" that is binding on the processor.
The EDPB's Guidelines 07/2020 on the concepts of controller and processor explain how to decide your roles. A vendor that decides on its own why and how to use your data, for example to train its own models, risks becoming a controller under Article 28(10). Stop that in the contract.
What is the 14-point DPA checklist?
Work through each line and mark it present, partial or missing.
| # | Item | Article | What good looks like |
|---|---|---|---|
| 1 | Subject matter, duration, nature and purpose | 28(3) | Specific to your project, not generic |
| 2 | Types of personal data and data subjects | 28(3) | Listed by category |
| 3 | Processing only on documented instructions | 28(3)(a) | Includes transfers abroad |
| 4 | Confidentiality of staff | 28(3)(b) | Written commitments from every engineer |
| 5 | Security measures | 28(3)(c), 32 | An annex naming real controls |
| 6 | Sub-processor authorization | 28(2), 28(3)(d), 28(4) | Prior approval and a current list |
| 7 | Help with data subject requests | 28(3)(e) | Response time in days |
| 8 | Help with security, breaches, impact assessments | 28(3)(f) | Named contact and process |
| 9 | Breach notice to you | 33(2) | Hours, not days |
| 10 | Deletion or return at the end | 28(3)(g) | Defined steps, a certificate |
| 11 | Information and audit rights | 28(3)(h) | Questionnaires, reports and on-site if needed |
| 12 | Duty to flag unlawful instructions | 28(3) | Present |
| 13 | Records of processing | 30(2) | Vendor keeps its own record |
| 14 | International transfers | Chapter V | SCCs and an assessment, see below |
How do you handle sub-processors?
Sub-processors are the vendor's own vendors, such as a cloud host, a monitoring tool or an AI model provider. Article 28(2) requires your authorization, either specific or general. With general authorization the processor must tell you about changes and give you a chance to object. Article 28(4) requires the same data protection terms to flow down to every sub-processor, and the original processor stays fully liable to you for their performance.
Ask for the current sub-processor list as an annex and set a notice period, commonly 30 days, for additions. If the vendor uses an LLM provider, name it, say where it processes data and whether it keeps prompts. For more on AI-specific data terms see IP and data terms for AI projects.
What breach notice should you ask for?
You, as controller, must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach under Article 33(1), unless the breach is unlikely to result in a risk to individuals. The vendor must notify you "without undue delay" (Article 33(2)), which is vague. Replace it with a number, such as 24 hours from discovery, and require the vendor to share what it knows, even if incomplete, rather than wait for a final report.
How do transfers to India work?
Chapter V of the GDPR restricts transfers outside the EU and EEA. India is not on the European Commission's list of adequacy decisions, so you need an Article 46 safeguard. The usual tool is the 2021 Standard Contractual Clauses, using Module Two for a controller sending data to a processor. Following the Schrems II judgment (C-311/18), you must also assess whether the destination's laws undermine the clauses and add supplementary measures if they do.
For software work, the best measures are practical. Use masked data for development, hold encryption keys in the EU, restrict production access to named staff, and log every session. For a worked example with German specifics, see software development for German companies. UK buyers have a parallel route, covered in UK GDPR data transfer to India.
What happens if the contract is weak?
Article 83(4) allows fines up to 10 million euros or 2 percent of worldwide annual turnover for breaching the controller and processor obligations, including Article 28. Article 82 lets individuals claim compensation, and a processor is liable where it has not complied with its own obligations or acted outside your instructions. Hiring a processor without sufficient guarantees is itself a controller failure.
How do you check the vendor beyond the paper?
A DPA is only as good as the vendor's practice. Ask for these.
- Security evidence. A recent audit report, a penetration test summary or a completed security questionnaire.
- Access design. Who can reach production data, through what path and with what logging.
- Incident procedure. A written one, with an owner on call.
- Training. How engineers are taught to handle personal data.
Put your breach-notice hours and sub-processor notice period at the top of the negotiation. Vendors who accept those two without a fight tend to accept the rest.
Frequently asked questions
Is a DPA the same as a data processing addendum?
Yes. Both terms mean the Article 28 contract, whether it is a standalone document or an addendum to a services agreement.
Do we need a DPA if the developer only sees test data?
Not if the data is truly anonymous or synthetic. If real personal data appears in test sets or logs, you do.
Can the vendor use our data to improve its own models?
Only if you authorize it and have a lawful basis. By default, prohibit it in the contract.
Is this legal advice?
No. It is a plain-language checklist based on the GDPR text. Confirm with qualified counsel.
A short close
A complete DPA takes a few days when both sides come prepared. Use the table above as your redline list, and treat a vendor's first reaction to it as a preview of working together.
Want this built for your team? Book a free 30-minute call.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.