Do you need a DPA? GDPR Article 28 and CCPA service provider terms

Who is who?

The label in the contract does not decide the role; what the vendor actually does with the data does. A vendor that uses your customers' data for its own product or advertising is acting for itself, whatever the DPA calls it.

When does each law require the contract?

GDPR. Article 28(3) requires that processing by a processor be governed by a contract (or another legal act) that binds the processor and sets out the subject matter, duration, nature and purpose of the processing, the type of personal data, the categories of data subjects, and the controller's obligations and rights. Article 28(4) requires the same terms to flow down to sub-processors.

CCPA. The statute defines a service provider and a contractor by reference to a written contract that contains specific prohibitions (§ 1798.140(ag) and (j)), and requires the business to have that contract (§ 1798.100(d)). The regulations list what the contract must say (Cal. Code Regs., tit. 11, § 7051(a)). A person without a contract that complies with section 7051(a) is not a service provider or contractor, and disclosing personal information to it may be considered a sale or sharing (§ 7050(e)).

Sources: GDPR, Regulation (EU) 2016/679; CCPA, Civil Code § 1798.100 et seq., as in force on 1 January 2026 (CPPA); CCPA Regulations, effective 1 January 2026 (CPPA).

Clause checklist: Article 28(3) and section 7051(a) side by side

Sources: GDPR, Article 28; CCPA Regulations, §§ 7050 and 7051 (CPPA).

A single DPA can carry both sets of terms. Where the vendor receives data from the EU, the contract will also need a transfer tool (usually the standard contractual clauses, or the vendor's certification under the EU-US Data Privacy Framework); see our guide on EU data transfers after the Data Privacy Framework.

Where do vendor DPAs usually fall short?

• Generic purposes. "To provide the services" is the kind of description section 7051(a)(2) does not accept. Name the services.
• Product improvement and AI training. The CCPA regulations allow a service provider to use the data internally to build or improve the services it provides to you, but not to perform services for another person (§ 7050(a)(3)). Training a general model that serves all customers needs a close look under both laws.
• Sub-processor notice without a real objection right. Article 28(2) requires that you can object to a new sub-processor. A notice that leaves you only the option to terminate, with no refund, should be negotiated.
• Audit rights replaced by certificates. A security certificate is useful evidence, but Article 28(3)(h) requires the vendor to allow audits. Agree how they work rather than delete them.
• Breach notice in fixed hours, or none. You have 72 hours to notify a supervisory authority under Article 33(1); the processor must notify you without undue delay (Art. 33(2)). Agree a short, fixed period.
• Deletion with no date. Set a period for deletion or return at the end of the contract, with a written confirmation.

Sources: GDPR, Articles 28 and 33; CCPA Regulations, § 7050(a)(3).

When should a DPA be reviewed by a lawyer?

When the vendor will process sensitive data, children's data or large volumes; when it will use AI models on your data; when data leaves the EU or the UK; when the vendor's paper is "non-negotiable" but your customer contracts promise more than it gives. This firm offers a free sample of its DPA Review Skill, sent by e-mail on request (northend.law/skills); the firm's software is built by its affiliated technology company, so we are not a neutral reviewer of it.

Checklist

• Role of the vendor decided on the facts (processor or service provider, or third party)
• Purposes stated specifically
• Vendor's own use of the data excluded, or expressly limited
• Sub-processor list, notice period and objection right
• Security measures, breach notice period, assistance duties
• Audit or assessment rights
• Deletion or return at the end, with a date
• Transfer tool where EU or UK data is involved
• Same terms flowed down to sub-processors

Questions people ask

Is a DPA required for a US company? If the company processes personal data of people in the EU for an EU customer, or is a controller subject to the GDPR, yes. Under the CCPA, a business needs the service provider terms in its contracts with vendors, whether or not the document is called a DPA.

Can we use the vendor's standard DPA? Often, if it contains the terms in the checklist. Read it against both columns of the table; most gaps are in purposes, own use and sub-processors.

Is the EU's model Article 28 contract enough? The European Commission's standard contractual clauses between controllers and processors (adopted by an implementing decision of 4 June 2021 under Article 28(7); see the Commission's page) meet Article 28, but they do not contain the CCPA terms. Add them.

What happens if we have no DPA? Under the GDPR, both parties are in breach of Article 28. Under the CCPA, the vendor is not a service provider, and the disclosure may count as a sale or sharing, which triggers notice and opt-out duties.

Update log

• 16 October 2026: first published; sources checked and citations added the same day. It replaces the earlier, shorter guide on data processing agreements, whose address now leads here.