# Article 28 data processing agreements explained | Illia BizTech > When a processing agreement is required, what it must contain, how to treat providers outside the EU and who carries liability. Source: https://illia-biztech.de/en/blog/avv-mit-dienstleistern 1. [Home](/en) 2. [Resources](/en/blog) 3. Data processing agreements with your providers ![Close up of a contract being signed with a pen on a desk](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_avv_mit_dienstleistern_cecf61d64e.png) ![Portrait of Illia Belichenko, technical specialist at Illia BizTech](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/small_Illia_Belichenko_author_81f88864f0.png) By: Illia Belichenko August 6, 2026 # Data processing agreements with your providers Data processing on behalf of a company happens when a provider handles personal data not for its own purposes but on the company's instructions, and almost every use of a cloud service, a newsletter tool, a CRM or a hosting provider falls under that definition, which is why a data processing agreement is needed almost every time. With hosting, newsletter sending, a CRM and an agency that has access to customer data, an agreement is required with practically no exceptions, since all of them technically touch personal data even when they have no say in why the data was collected in the first place. No agreement is needed where a provider decides the purposes and means of processing itself and acts as an independent or joint controller rather than following instructions. A tax adviser running the books under their own professional rules usually falls into that category rather than that of a processor. The company, not the provider, is liable toward the website visitor, even when a data breach happens on the hosting or CRM side. The data processing agreement splits responsibility between company and provider between themselves, but it does not relieve the company of answering to the person whose data was processed. [Article 28(3) of the GDPR](https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex:32016R0679) requires the agreement to fix the subject matter and duration of processing, its nature and purpose, the type of data and categories of data subjects, the provider's obligations toward the company's instructions, the conditions for bringing in sub-processors, what happens to the data on deletion or return after the contract ends, and the company's right to actually check how the provider processes the data. If the provider transfers data outside the European Union, the agreement or an annex to it needs its own transfer safeguards, usually EU standard contractual clauses, not just a note that the service happens to sit in another country. In an agreement already signed, three things are worth checking. Whether it names concrete categories of data and people rather than a vague phrase like customer personal data. Whether the company has an audit right rather than just the provider's own assurance. And whether it describes what happens to the data once the contract ends. A missing or incomplete data processing agreement shows up as a significant factor in more than a third of German GDPR fines, and the maximum penalty under this article reaches up to 10 million euro or 2 percent of worldwide annual turnover, whichever is higher. Good practice on the provider's side looks simple. The data processing agreement gets offered on its own, without the client having to ask for it, uses concrete wording instead of generic phrases, and needs no separate negotiation every time a client raises the question. **Share** [ ![A content plan and post drafts laid out on a desk](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_monthly_content_plan_e5cb6daa31.png) Previous Post Building a monthly content plan without posting for the sake of it](/en/blog/monthly-content-plan) [ ![A contact form open on a laptop screen on a desk with a plant](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_kontaktformular_dsgvo_ed5ebef426.png) Next Post Building a contact form that meets the GDPR](/en/blog/kontaktformular-dsgvo) ![Portrait of Illia Belichenko, technical specialist at Illia BizTech](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/small_Illia_Belichenko_author_81f88864f0.png) ##### Illia Belichenko Illia is responsible for the technical side of Illia BizTech: website development, website updates, forms, integrations, automation and technical support. He works on connecting websites, content, advertising and internal workflows so they work together without creating unnecessary manual work. ##### Recent Posts [![An editor working in video editing software with AI features on screen](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_ki_tools_videoschnitt_vor_und_nachteile_f3a71162be.png)](/en/blog/ki-tools-videoschnitt-vor-und-nachteile) #### [What AI Editing Tools Actually Do, and What They Don't](/en/blog/ki-tools-videoschnitt-vor-und-nachteile) October 16, 2026 [](/en/blog/ki-tools-videoschnitt-vor-und-nachteile) [![A video editor reviewing a flawed shot on a monitor before deciding on a reshoot](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_content_nachdrehen_oder_um_fehler_schneiden_f8735cb368.png)](/en/blog/content-nachdrehen-oder-um-fehler-schneiden) #### [When a Reshoot Pays Off and When Editing Can Save the Footage](/en/blog/content-nachdrehen-oder-um-fehler-schneiden) October 15, 2026 [](/en/blog/content-nachdrehen-oder-um-fehler-schneiden) [![A video editor selecting a cover frame for a video on a laptop screen](/_ipx/f_webp,q_75/https://cms.illia-biztech.de/uploads/medium_thumbnail_vorschaubild_video_wirkung_a1fe6c0cd9.png)](/en/blog/thumbnail-vorschaubild-video-wirkung) #### [Why the Video Thumbnail Decides Whether Anyone Clicks](/en/blog/thumbnail-vorschaubild-video-wirkung) October 14, 2026 [](/en/blog/thumbnail-vorschaubild-video-wirkung) A data processing agreement is needed with every provider that stores or processes visitor data on a site's behalf, including hosting and newsletter tools. Illia BizTech works out with the client early on which of the site's providers fall under this requirement, rather than leaving the question of a processing agreement for the moment a regulator asks about it. Illia BizTech builds and maintains websites for companies in Germany in German, English, Russian and Ukrainian, from the first version through ongoing maintenance and search visibility work. One monthly plan covers the website, advertising and content, the scope is agreed in advance and can be moved between them when priorities change. The domain, hosting and ad accounts stay registered to the company, so the work can continue on the existing setup without a full rebuild. That fits businesses moving to Germany or expanding into the German-speaking market who want to explain their task once.