Who signs a data processing agreement, and on whose behalf?
Short answer
The agreement is signed by the same parties that entered into the main contract: the controller — your organisation — and the processor, that is, the service provider. It is signed by a person authorised to represent the organisation: the director or an authorised employee.
On this page
1.First, establish who the controller is
The controller is whoever decides the purpose and means of the processing. In practice, this is the organisation that collected the data and needs it for its activities. A service provider working on your instructions is a processor, even if it technically understands the system better than you do.
A mistake we see often: the agreement is signed by the group company that negotiated the price, while a different one actually controls the data. The document then formally exists but binds the wrong party. Before signing, it is worth writing one sentence stating whose data is being processed and for whose purposes.
2.Who has the right to sign
It is signed by the director or a person who has been given authority to do so. If an authorised employee signs, the scope of their authority must cover agreements of this kind. For the rules on representation, see Article 2.137(2) of the Civil Code (scope of a power of attorney) and Article 2.81(1) (organs of a legal person).
An electronic signature is just as valid as a handwritten one, provided it meets the legal requirements. More important than the form is that the signed copy is kept somewhere you will find it: alongside the main contract, and noted in the list of providers.
3.Group companies and joint controllers
If several group companies use the same system, each of them is generally an independent controller and each needs its own contractual basis. This can be resolved with one agreement that companies accede to, or with separate agreements — what matters is that each company is named.
When two organisations jointly decide the purposes and means, they are joint controllers, and a different kind of arrangement is needed between them: who informs individuals, who responds to requests, who liaises with the supervisory authority. The essence of that arrangement must also be made available to the individuals themselves.
4.What to do before signing
Three checks take fifteen minutes and eliminate most problems. First: whether the parties to the agreement match those that actually control and process the data.
Second: whether the described data types match what the provider actually sees. Third: whether it clearly states what happens to the data once the agreement ends.
Once signed, record the agreement in the provider list with the date and a short description. This is the only way to quickly answer, later on, which providers have an agreement and which are still missing one.
Official legal text
We do not paraphrase the regulation's provisions here. The official Lithuanian text of the GDPR is available in one place and is more precise than any summary.
GDPR text in Lithuanian (EUR-Lex)