Legal basics & privacy · · 4 min read · By Alexander
Data processing agreement: when your business needs one
A German AV-Vertrag, or data processing agreement, governs how a service provider handles personal data on your instructions. For small businesses, it often applies to hosting, newsletters, cloud software and website maintenance.
What is an AV-Vertrag under GDPR?
Under Article 4(8) GDPR, a processor handles personal data on behalf of the controller. The controller determines the purposes and essential means, while the provider follows documented instructions.
Article 28(3) requires a contract or other binding legal act. Article 28(9) allows electronic form, provided the parties, content and conclusion remain verifiable.
When does a small business need one?
A DPA is needed when an external provider processes personal data for your purposes. Common examples include hosting, maintenance with database access, email newsletters, cloud CRM, booking tools, payroll services and support platforms.
Not every provider is a processor. Tax advisers, lawyers and payment providers may act as independent controllers, while jointly determined purposes may require an Article 26 arrangement. The actual role matters more than the contract label.
- hosting of forms, logs or customer data
- agency access to databases or mailboxes
- newsletter distribution
- cloud storage of customer or employee data
- support access to personal ticket content
What must the agreement contain?
Article 28(3) lists subject matter, duration, purpose, data types, categories of people and the controller’s rights and duties. It also covers confidentiality, security, assistance, deletion or return and audit information.
The agreement should include current technical and organisational measures such as access controls, permissions, encryption, backups, recovery and testing under Article 32 GDPR.
What about subprocessors and international transfers?
Article 28(2) requires prior specific or general written authorisation for subprocessors. With general authorisation, the provider must notify changes so the controller can object.
If data is accessible outside the EEA, the DPA alone is not enough. Articles 44 and following require an adequacy decision or other safeguards. Check storage, support locations and the complete subprocessor list.
Who provides the DPA and when?
Providers usually supply their own document because they know their systems and subprocessors. Controllers must still use only processors offering sufficient guarantees under Article 28(1).
Conclude the agreement before processing begins and keep it with the main contract, security measures and transfer documents. Review it whenever services or locations change.
Do hosting and website agencies always require one?
Hosting commonly involves processing because the provider stores logs, forms and databases. An agency needs a role assessment: pure design with dummy data differs from ongoing hosting, backups, analytics and support using real customer data.
A website subscription can combine hosting, maintenance and support with clearer responsibilities, but every business should still document which provider receives which data and why.
How can you check the agreement quickly?
Verify the parties, real service, data categories, affected people, security measures, subprocessors and international transfers. Ask for missing documents and record the response.
A DPA does not replace a privacy notice, legal basis or consent. It governs the processor relationship; the underlying processing must still be lawful. This guide is not individual legal advice.
Frequently asked questions
Are AV-Vertrag and AVV the same?
Yes. Both refer to the Article 28 GDPR processing agreement.
Must it be signed on paper?
No. Article 28(9) expressly permits electronic form, but conclusion should be provable.
Do I need one with my host?
Usually yes when the host processes logs, form entries or customer data on your behalf.
Is a DPA enough for US providers?
No. International transfer requirements under Articles 44 and following also apply.
Where should it be stored?
Keep it with the main contract, security measures, subprocessor list and processing records.