Independent: paid links never change the order. Every fact checked with the vendor.

How we review
stackwijsSearch software…Search
Submit a tool

Data processing agreement and the GDPR

If an online tool stores personal data of your customers or staff, that vendor is usually your processor. The GDPR then requires a written data processing agreement.

Controller and processor

You are the controller if you decide which personal data you process, for what purpose and how. A processor processes that data on your behalf and does not use it for its own purposes.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) gives outsourcing your accounting and a cloud service that stores personal data as examples.

What does the GDPR require?

If you work with a processor, you must have a data processing agreement together (Article 28(3) GDPR). If it is missing, you are both in breach.

The controller often takes the initiative, but the agreement may also come from the processor. You do remain responsible for the processing yourself.

What does it contain?

According to the AP, the data processing agreement records, among other things:

  • A description: the subject, duration, nature and purpose of the processing, which personal data and whose.
  • That the processor only acts on your written instructions and does not use the data for its own purposes.
  • A duty of confidentiality for those at the processor who work with the data.
  • Appropriate technical and organisational security.
  • That the processor does not engage a sub-processor without your prior written permission.

All dates that affect your software, from e-invoicing to payroll, are in the legislation calendar. You can also add it to your calendar.

Why it matters for freelancers and SMEs

Even as a freelancer (zzp) you are responsible for your customers' personal data. If you work with a processor without a data processing agreement, you are in breach according to the AP.

If the vendor offers a data processing agreement itself, you do not have to draw one up. Do check that the points above are in it.

Tools in the guide that offer a data processing agreement

Only tools whose vendor says so itself, in the categories where this point counts in the Netherlands check. Each tool shows when we checked it.

Accounting (18)

CRM (20)

Email marketing (14)

Scheduling and HR (12)

Online store (6)

Payroll (7)

Time tracking (6)

POS systems (8)

Payment providers (8)

Website builders (9)

Appointments and bookings (9)

E-signatures (13)

Invoicing (8)

Business phone (8)

Project management (12)

Forms and surveys (6)

Social media scheduling (4)

Customer service and chat (7)

Reviews and testimonials (2)

SEO tools (4)

AI assistants and meeting notes (10)

AI tools (4)

Video and screen recording (4)

Developer tools (6)

Frequently asked questions

Is a data processing agreement mandatory?

Yes, if you work with a processor: a party that processes personal data on your behalf. The GDPR requires it of both parties (Article 28(3)).

Who draws up the data processing agreement?

Either party may. The controller often does it, but the agreement may also come from the processor. You remain responsible for the processing yourself.

Is a software vendor always a processor?

Not always. A processor only uses the data for your assignment. If a party also uses it for its own purposes, it is itself responsible for that. The AP explains how to make that distinction.

Which software offers a data processing agreement?

In our guide, 205 tools say so on their own site (18 in accounting, 20 in CRM, 14 in email marketing, 12 in scheduling and hr, 6 in online store, 7 in payroll, 6 in time tracking, 8 in POS systems, 8 in payment providers, 9 in website builders, 9 in appointments and bookings, 13 in e-signatures, 8 in invoicing, 8 in business phone, 12 in project management, 6 in forms and surveys, 4 in social media scheduling, 7 in customer service and chat, 2 in reviews and testimonials, 4 in SEO tools, 10 in AI assistants and meeting notes, 4 in AI tools, 4 in video and screen recording and 6 in developer tools). For other tools the vendor does not say, or not clearly.

Sources

  1. Autoriteit Persoonsgegevens: Data processing agreement (in Dutch)
  2. Autoriteit Persoonsgegevens: Controller and processor (in Dutch)

Sources checked on . Rules and plans can change; the source prevails. This is an explanation, not legal or tax advice.