What must a GDPR DPA contain?

GDPR Article 28(3) requires the DPA to set out the subject-matter, duration, nature and purpose of processing, the type of personal data and categories of data subjects, and the controller's obligations — plus binding clauses on confidentiality, security, sub-processing, assistance, deletion, and audits.

Do I need a different DPA for each EU country?

No — the Article 28 clause requirements are uniform across the EU, so one well-drafted DPA generally works EU-wide. National supervisory authorities differ in guidance and enforcement emphasis, not in the mandatory clauses.

Who enforces the DPA rules in my country?

Your national supervisory authority — the CNIL in France, the BfDI and Länder authorities in Germany, the AEPD in Spain, and so on. The row above links the official register; check your authority's own guidance for national emphasis.

Does miniterms give me legal advice on my DPA?

No. miniterms generates a structured DPA from your inputs as general information, not individualised legal advice. Review it against your supervisory authority's guidance, and consult a professional before relying on it for a specific situation.

Living guide

GDPR Data Processing Agreement (DPA) requirements by country

Under GDPR Article 28, any business that uses a processor needs a Data Processing Agreement. The mandatory clauses are EU-wide; supervisory-authority expectations vary by country. This page tracks both, updated quarterly.

Last reviewed 11 July 2026 · updated quarterly

	Country	Supervisory authority / national note	Status	Basis
DE	Germany	Federal BfDI plus 16 Länder authorities; German guidance is notably strict on technical and organisational measures (TOMs). Confirm with the authority for your Land.	In force	Art. 28(3) GDPR ↗
FR	France	CNIL is the supervisory authority; it publishes DPA guidance and model processing clauses. Verify against current CNIL guidance.	In force	Art. 28(3) GDPR ↗
ES	Spain	AEPD is the supervisory authority and issues detailed processor guidance. Confirm requirements against the AEPD.	In force	Art. 28(3) GDPR ↗
IT	Italy	Garante per la protezione dei dati personali is the supervisory authority and has published its own guidance on processor designations. Confirm requirements against the Garante.	In force	Art. 28(3) GDPR ↗
NL	Netherlands	Autoriteit Persoonsgegevens (AP) is the supervisory authority. The Article 28 clause set applies; check AP guidance for national emphasis.	In force	Art. 28(3) GDPR ↗
IE	Ireland	The Data Protection Commission (DPC) supervises many large processors headquartered in Ireland; its enforcement decisions shape processor practice EU-wide.	In force	Art. 28(3) GDPR ↗
BE	Belgium	The Belgian Data Protection Authority (APD/GBA) is the supervisory authority. Its 2026–2028 strategic plan shifts enforcement toward large-scale processing and AI; the Article 28 clauses still apply uniformly. Check APD/GBA guidance.	In force	Art. 28(3) GDPR ↗
AT	Austria	The Datenschutzbehörde (DSB) is the supervisory authority. Article 28 clauses apply uniformly; check DSB guidance for national emphasis.	In force	Art. 28(3) GDPR ↗
PL	Poland	The Personal Data Protection Office (UODO) is the supervisory authority. Article 28 clauses apply uniformly; check UODO guidance for national emphasis.	In force	Art. 28(3) GDPR ↗
PT	Portugal	The Comissão Nacional de Proteção de Dados (CNPD) is the supervisory authority. Article 28 clauses apply uniformly; check CNPD guidance for national emphasis.	In force	Art. 28(3) GDPR ↗
LU	Luxembourg	The Commission Nationale pour la Protection des Données (CNPD) is the supervisory authority. Article 28 clauses apply uniformly; check CNPD guidance for national emphasis.	In force	Art. 28(3) GDPR ↗
FI	Finland	The Office of the Data Protection Ombudsman is the supervisory authority. Article 28 clauses apply uniformly; check the Ombudsman's guidance for national emphasis.	In force	Art. 28(3) GDPR ↗
DK	Denmark	Datatilsynet is the supervisory authority and has published DPA templates and guidance. Verify against current Datatilsynet guidance.	In force	Art. 28(3) GDPR ↗
SE	Sweden	IMY (Integritetsskyddsmyndigheten) is the supervisory authority and an active enforcer in the Nordics. Article 28 clauses apply; check IMY guidance.	In force	Art. 28(3) GDPR ↗

Each key date links to the authority it was verified against. Announced dates move — always confirm at source.

FAQ

What must a GDPR DPA contain?: GDPR Article 28(3) requires the DPA to set out the subject-matter, duration, nature and purpose of processing, the type of personal data and categories of data subjects, and the controller's obligations — plus binding clauses on confidentiality, security, sub-processing, assistance, deletion, and audits.
Do I need a different DPA for each EU country?: No — the Article 28 clause requirements are uniform across the EU, so one well-drafted DPA generally works EU-wide. National supervisory authorities differ in guidance and enforcement emphasis, not in the mandatory clauses.
Who enforces the DPA rules in my country?: Your national supervisory authority — the CNIL in France, the BfDI and Länder authorities in Germany, the AEPD in Spain, and so on. The row above links the official register; check your authority's own guidance for national emphasis.
Does miniterms give me legal advice on my DPA?: No. miniterms generates a structured DPA from your inputs as general information, not individualised legal advice. Review it against your supervisory authority's guidance, and consult a professional before relying on it for a specific situation.

Disclaimer

General information compiled from public sources, not individualised legal advice. Confirm requirements with your supervisory authority or counsel before relying on them.