Who is responsible for what in a GDPR data processing agreement?

A GDPR data processing agreement must clearly set out the allocation of responsibilities between the controller and the processor. This is essential both to meet legal requirements and to avoid boundary issues when questions of liability arise, for example in the event of an incident.

The controller determines the purposes and means of the processing. The processor may only process personal data on the basis of documented instructions — never on its own initiative. A clear personal data processing agreement is therefore central to directing the processor and to demonstrating that both parties comply with the Regulation’s requirements, including relevant gdpr incident reporting requirements.

The agreement should, among other things, regulate:

• Who is responsible for incident reporting in line with gdpr incident reporting requirements.
• What technical and organisational security measures must be implemented.
• How instructions are given and amended during the engagement.
• What will happen to personal data when the engagement ends (return, deletion, or both).

Common pitfalls in a GDPR data processing agreement

A frequent pitfall is an agreement that is overly general and not tailored to the specific processing in scope. This can leave gaps on security, accountability and incident-handling routines. Another issue is failing to regulate which sub-processors the processor may appoint and on what terms. Without clear conditions, the processor may engage parties that do not meet the standards expected of sub-processors, raising the risk of personal data incidents and, ultimately, gdpr sanctions for non compliance.

Ambiguity around audit rights is also common, for example unclear terms on how and when the controller may conduct checks or audits. GDPR requires the processor to make available all information necessary to demonstrate compliance — including a right of inspection. If this is not clearly regulated, disputes can arise over oversight and visibility into the processor’s internal processes. Agreements also often lack a clear plan for deletion or return of personal data when the contract ends. That step is crucial to prevent unauthorised processing after the engagement concludes and aligns with processor obligations under gdpr.

For small and mid-sized businesses, negotiating detailed terms can be challenging, particularly when the counterparty is a major supplier. It is therefore prudent to involve legal support at the outset. A GDPR specialist can identify risks, propose tighter provisions and refine language so the agreement is practically workable. This reduces commercial risk and the likelihood of gdpr sanctions for non compliance during supervision.

Unclear or incomplete agreements can result in processing that breaches GDPR. At Morling Consulting, our GDPR lawyers review and clarify the division of responsibilities in data processing agreements and ensure alignment with gdpr incident reporting requirements and processor obligations under gdpr.

Translate policy into practice by defining controls, reporting lines and evidence. Map roles, test instructions, document security measures and confirm handover steps at contract end. These actions support compliance and reduce exposure to gdpr incident reporting requirements breaches and related enforcement.