What should you do when your provider doesn’t have a data processing agreement (DPA) to offer?

Jovan Stevovic -

Working with a provider that doesn’t offer a Data Processing Agreement (DPA) can be a real challenge, especially when you need to prove to your customers that you are GDPR compliant. 

This is true also when you’re the data controller since you have the responsibility to ensure that the DPAs with providers are in place. 

But what if your provider doesn’t offer a DPA? In other words, it becomes harder to protect personal data and demonstrate compliance to your customers, which can lead to serious risks (and missed deals).

Don’t worry—there are steps you can take to stay compliant and safeguard your business. Let’s explore your options.

In this blog post, we’ll explore the steps you can take to navigate this challenge and close your deals.

Whether you draft a DPA yourself or consider switching to a more compliant provider, we've got you covered. 💼

Let’s dive in!

Understanding the Importance of a Data Processing Agreement (DPA) 📜

Before diving into solutions, it’s essential to understand why a DPA is so important.

Under the GDPR, any company that handles personal data needs to have strict agreements in place with third-party providers who process data on their behalf. These agreements (aka DPAs) lay out the responsibilities of each party regarding data protection, ensuring that the provider (in legalese, the data processor) follows the necessary regulations.

Without a DPA, you risk non-compliance, which can lead to huge fines 💸, not to mention damage to your reputation.

Therefore, when a provider doesn’t offer a DPA, it can be a significant roadblock for you and your business. But don’t worry—we’ve got solutions to this challenge.

Option 1: Create the DPA yourself 📝

One option is to draft the DPA yourself. This might sound intimidating, but with the right resources, it can be a manageable process. Many companies have found success by creating DPAs for their providers when the latter doesn't have one to offer.

Here’s how to do it:

  1. Start with a template: Don’t panic! Luckily, you don’t have to start from scratch. At Chino.io, we provide a free DPA template that you can use as a solid foundation. This template includes all the essential elements you need, such as the scope of processing, data types, and security measures. It’s a great place to start! 🚀Also, the EDPB provides good indications about who to write your own DPA.
  2. Include key details: When drafting your DPA, ensure you cover all the relevant details. This includes identifying any subprocessors, specifying the types of personal data being processed, and outlining the security measures that should be in place. It’s essential to be as transparent and detailed as possible. ✅
  3. Collaborate with your provider: You can’t do this alone! Once you have a draft, it’s crucial to collaborate with your provider to gather all the necessary details. Ask for information on their subprocessors, data security protocols, and how they handle personal data. Their input is vital to ensure that your DPA is accurate and comprehensive. 🤝
  4. Prepare for pushback: Unfortunately, it may be a long and winding road - and, drafting a DPA doesn’t always guarantee smooth sailing. Some providers may be reluctant to sign the agreement, even after you’ve done the work. Be prepared to negotiate and possibly present multiple versions of the document before coming to an agreement. However, without a signed DPA, you can’t claim full GDPR compliance. This is a non-negotiable aspect of the regulation. 🚫

Option 2: Consider other providers 🏢

If drafting a DPA sounds too cumbersome, or if your provider refuses to sign, you may want to consider switching to a different provider. While this might seem like an extreme step, it’s worth it in the long run to ensure your business remains GDPR compliant.

Many large, well-known providers, such as AWS and Microsoft Azure, offer ready-made DPAs. These agreements are designed to ensure they meet GDPR requirements, so you won’t have to worry about drafting or negotiating a DPA from scratch. 📂

Here’s why switching providers can be a good option:

  1. Assured compliance: Providers like AWS and Google Cloud have already established GDPR-compliant practices. Their DPAs are designed to meet all the regulatory requirements, which means less work for you and more peace of mind. ✅
  2. Scalability and trust: Large providers often have the infrastructure and resources to manage data securely. This can give your business added security, especially if you’re handling sensitive customer information. Plus, working with a reputable provider can boost your clients' confidence in your company. 💼
  3. Future-proofing: As data privacy laws evolve, top providers are more likely to stay ahead of regulatory changes, keeping their agreements and practices up to date. This ensures you’ll continue to be compliant as new rules emerge. 📈

Switching to a provider with a ready-made DPA can save time, effort (and stress) in the long run, making it a strong consideration if your current provider cannot offer what you need.

Failing to have a signed DPA in place is not just a procedural oversight—it’s a legal issue. 

Under the GDPR, if you’re a data controller, you are legally required to have a written agreement with any data processor handling personal data on your behalf. Without this, you’re exposed to several risks:

  1. Fines: GDPR non-compliance can lead to fines of up to €20 million or 4% of your annual global turnover, whichever is higher. That’s a huge penalty for something as simple as a missing DPA. 🛑
  2. Data breaches: Without a proper DPA, you might not be aware of how your provider is handling your data. This opens up the risk of data breaches, which can lead to further penalties and damage to your brand’s reputation. 🚨
  3. Loss of trust: Customers and clients today are more aware than ever of data protection. A lack of compliance could cause you to lose the trust of your clients, leading to a potential loss of business. Trust is hard to regain once lost. 😕

For these reasons, ensuring you have a signed DPA with every provider is not just a box to tick—it’s a critical aspect of running a compliant and secure business.

Stay proactive and stay compliant 🛡️

When your provider doesn’t offer a Data Processing Agreement, it might seem like an huge obstacle. 

However, there are clear steps you can take to navigate this challenge. Whether you draft a DPA yourself or consider switching to a more compliant provider, it’s crucial to stay proactive. 💪

Data protection is not just a legal requirement; it’s an essential part of building trust with your customers and ensuring the long-term success of your business. By taking action now—whether by creating a DPA or finding a provider who already has one—you’re safeguarding your company’s future and protecting the valuable data you’re entrusted with. 🔐

Need help figuring it out? We’re here to help! 🙋

Chino.io is the one-stop shop for solving all privacy and security compliance aspects.

As a partner of our clients, we combine regulatory and technical expertise with a modular IT platform that allows digital applications to eliminate compliance risks and save costs and time.

Chino.io makes compliant-by-design innovation happen faster, combining legal know-how and data security technology for innovators.

To learn more, book a call with our experts.