Do I need a Data Processing Agreement with this vendor?
Yes, if they process personal data on your behalf. GDPR Art. 28 requires a written agreement before you go live.
Try this first
- 1Decide the role. Processor when they only execute (cloud storage, mail provider, payroll). Controller when they set purpose and means (bank, accountant). The latter does not need a DPA but does need clear terms.
- 2Ask the vendor for their standard DPA. Microsoft, Google, AWS, Salesforce all publish one and you accept it in their portal. Print the proof.
- 3Confirm purpose, data types, retention, sub-processors and non-EEA transfers are spelled out. Generic DPA without an annex is not enough.
- 4Custom DPA? Use the AP model or a NOREA template as the base. Writing from scratch goes wrong more often than not.
- 5File the signed copy in the processing register entry for that activity.
When to bring us in
Vendor refuses a DPA or wants unlimited sub-processors? That is not a vendor issue, it is a red flag. Call us before you sign.
See also
- Does NIS2 apply to my company?Two questions decide it: are you in a listed sector, and do you meet the threshold from Recommendation 2003/361/EC (more than 50 FTE and more than EUR 10M turnover or balance sheet). Below that you are only indirectly in scope, via your customers. The threshold determines whether you are an important or essential entity depending on sector.
- What changes with the Dutch Cyber Security Act?The Cyberbeveiligingswet is the Dutch implementation of NIS2. Track NCSC for the exact effective date and the lower regulations.
- Am I personally liable as a director under NIS2?Yes. The board is accountable for approving and overseeing the cyber measures. Severe negligence can become personal.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.