If your SaaS platform handles personal data on behalf of business customers, you are likely operating as a data processor under the GDPR and a service provider under the CCPA and CPRA. That classification carries a legal requirement: a data processing agreement (DPA) must be in place between you and each business customer before you process their users’ data.
Many B2B SaaS companies do not have a standalone DPA, or they bury inadequate data processing language in their general terms of service. Both approaches create compliance risk, particularly as enterprise buyers and their legal teams increasingly require a proper DPA as a condition of signing. Here is what a data processing agreement is, what it must include, and why getting it right matters for your business.
What Is a Data Processing Agreement?
A data processing agreement is a contract between a data controller (your business customer, who determines the purpose of data collection) and a data processor (your SaaS platform, which processes data on the controller’s behalf). The GDPR requires this agreement under Article 28 whenever a controller engages a processor to handle personal data.
Under the CCPA and CPRA, a similar document is required for service provider relationships. If your SaaS business receives personal information from a California-based business, the agreement must include language specifying that the information is shared for a limited business purpose, that you will not sell or share it beyond that purpose, and that you will delete or return it upon request.
These are not optional provisions. Businesses that share personal data with SaaS platforms without a proper DPA are out of compliance with both regulations, and so are the SaaS platforms operating without one.
Who Needs a DPA?
Your SaaS platform needs a DPA in place with each business customer whose data you process if:
- Your platform stores, transmits, or processes personal data belonging to your customer’s employees, end users, or clients
- Your customer is subject to the GDPR because they serve EU-based individuals
- Your customer is subject to the CCPA or CPRA because they are a California business above the threshold
- Your customer is subject to any of the growing number of US state privacy laws (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, and others) that have similar service provider contract requirements
If your SaaS platform stores customer records, processes transactions, manages employee data, runs marketing automation, or handles support tickets, personal data is involved. The DPA is the legal instrument that governs how you handle it.
What a GDPR-Compliant DPA Must Include
Article 28 of the GDPR specifies the minimum content required for a valid data processing agreement. Your DPA must address:
Subject Matter and Duration
The DPA must describe what data processing activities are covered, the duration of the processing, and the nature and purpose of the processing. Generic language like “process data as instructed” is not sufficient. The DPA should specify whether you are processing contact data, transaction records, usage analytics, support data, or other categories.
Categories of Data Subjects and Personal Data
The agreement must identify who the data subjects are (the customer’s end users, employees, or clients) and what categories of personal data are involved (names, email addresses, payment data, behavioral data, and so on).
Controller Instructions
The DPA must state that you, as processor, process personal data only on documented instructions from the controller (your customer), unless required otherwise by law. It must also require you to inform the controller if you believe any instruction violates applicable privacy law.
Confidentiality Obligations
All personnel with access to the personal data must be under confidentiality obligations. The DPA should state this obligation and your responsibility for ensuring it is in place.
Security Measures
The DPA must require you to implement appropriate technical and organizational security measures to protect the personal data. The GDPR does not mandate specific measures but requires that they be appropriate to the risk. Your DPA should reference your security practices and, if relevant, your SOC 2 certification or ISO 27001 compliance.
Subprocessors
If you engage sub-processors (cloud infrastructure providers, analytics tools, support platforms, or other third parties that access your customers’ data), the DPA must address this. Under the GDPR, you need either specific consent from the controller for each sub-processor or a general authorization clause allowing you to engage sub-processors subject to notification obligations and the same contractual protections.
Data Subject Rights Assistance
The DPA must require you to assist your customer in fulfilling data subject rights requests under the GDPR: access, rectification, erasure, restriction of processing, portability, and objection. Your agreement should specify how you will support these requests operationally and within what timeframe.
Data Breach Notification
The DPA must require you to notify the controller without undue delay after becoming aware of a personal data breach. GDPR requires controllers to notify supervisory authorities within 72 hours of becoming aware of a qualifying breach. Your DPA should set a notification timeline that gives your customer enough time to meet that obligation.
Deletion or Return of Data
At the end of the contractual relationship, you must delete or return all personal data to the controller, depending on their preference, and certify that deletion is complete. The DPA should specify the process and timeline for this.
Audit Rights
The controller must have the right to audit your data processing activities and verify compliance with the DPA. In practice, most SaaS companies satisfy this by providing access to third-party audit reports (such as SOC 2 Type II reports) rather than allowing direct site inspections. Your DPA should specify how audit rights are fulfilled.
International Data Transfers
If your SaaS platform transfers personal data from the EU to the United States, the DPA must address the legal mechanism for that transfer. Following the invalidation of Privacy Shield, the primary mechanism is the EU Standard Contractual Clauses (SCCs), updated in 2021. If your platform transfers EU personal data to US servers, the SCCs must be incorporated into your DPA or executed as a separate addendum. This is a frequent gap for US SaaS companies serving EU customers.
See the broader picture of CCPA and CPRA privacy requirements for US businesses in 2026, which increasingly intersect with international transfer obligations for SaaS platforms operating across jurisdictions.
What US State Privacy Laws Require in Service Provider Agreements
The CCPA and CPRA require a written contract with any service provider that processes personal information. The contract must prohibit the service provider from selling the personal information, using it for any purpose beyond the specified business purpose, retaining it longer than necessary, and combining it with personal information from other sources except as permitted.
Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws have similar requirements. The specifics vary, but the common thread is that personal data shared with a SaaS vendor for a business purpose must be governed by a written agreement that restricts the vendor’s use of that data. If you are a SaaS platform receiving personal information from businesses in these states, you need service provider agreements in place. See the detailed key provisions in a SaaS agreement that frequently need to be updated when these obligations apply.
Why a Standalone DPA Is Better Than DPA Language in Your ToS
Embedding data processing provisions in your general terms of service is a common shortcut. It is also a problematic one. Enterprise buyers often require a separate, executable DPA that their legal and compliance teams can review, sign, and retain independently of the service agreement. Embedding these provisions in ToS that are accepted by clicking a button creates procedural complexity when a buyer’s procurement team needs a signed document.
A standalone DPA also makes it easier to update data processing terms as privacy law evolves without revising your entire terms of service. As state privacy laws continue to emerge and international frameworks shift, the ability to update a single document that governs data processing is operationally valuable.
What a Technology Lawyer Builds Into a DPA That Templates Miss
Standard DPA templates, including the ones available from EU data protection authorities, provide a useful starting point. They do not account for your specific sub-processor stack, your breach notification capabilities, your geographic footprint, or the specific data categories your platform processes. A technology lawyer who works with SaaS companies builds a DPA that maps to your actual architecture, reflects your security posture, and positions your platform well with enterprise legal teams conducting vendor due diligence.
For SaaS companies pursuing enterprise deals, a well-drafted DPA is not just a compliance document. It is a commercial asset that reduces friction in the sales process and signals to buyers that your platform takes data governance seriously.
Frequently Asked Questions
Is a DPA required even if my SaaS platform does not sell user data?
Yes. The requirement for a DPA under the GDPR is triggered by the fact that you process personal data on behalf of a controller, not by whether you sell that data. Even if your platform only uses customer data to provide the contracted service and does nothing else with it, a DPA is still required by law if any of that data involves EU-based individuals.
Can I use a template DPA or do I need a custom one?
Template DPAs provide a useful foundation but rarely account for the specifics of your platform’s architecture, sub-processors, breach notification capabilities, or the data categories you actually process. Enterprise buyers often negotiate DPA terms. Having a custom DPA that accurately reflects your platform, rather than a template with placeholder language, makes those negotiations smoother and reduces the chance of commitments you cannot actually meet.
What is the penalty for operating without a DPA under the GDPR?
Processing personal data without an adequate DPA in place is a violation of Article 28 of the GDPR. Penalties can reach up to 10 million euros or 2% of global annual turnover, whichever is higher. Supervisory authorities have issued fines for DPA deficiencies, particularly in cases where the absence of a compliant agreement contributed to a data breach or data misuse incident.
Do I need a separate DPA for each customer or can I use a standard one?
Many SaaS platforms use a standard DPA that is offered to all customers, which customers execute individually. This approach is efficient and workable as long as the standard DPA accurately reflects your processing activities. Some enterprise customers will request modifications; having a lawyer-drafted base document makes those negotiations easier to manage.
What is the difference between a data processing agreement and a data sharing agreement?
A data processing agreement governs the relationship between a controller and a processor: the processor acts on the controller’s instructions and processes data for the controller’s purposes. A data sharing agreement governs transfers between two controllers that each determine how the shared data will be used. SaaS B2B relationships are almost always controller-processor relationships, requiring a DPA. Joint ventures or partnerships where both parties determine the purpose of data use may require a data sharing agreement instead.
Conclusion
A data processing agreement is a legal requirement for B2B SaaS companies that handle personal data under GDPR, CCPA, CPRA, and an expanding set of US state privacy laws. Without one, your platform is out of compliance, your enterprise sales process is complicated, and your exposure in a data incident is significantly higher than it needs to be.
Contact Hansen Tong at TOSLawyer.com to have a data processing agreement drafted or reviewed by a technology lawyer who understands the GDPR, US state privacy laws, and what enterprise buyers actually require in a compliant SaaS vendor relationship.