Do you need a data processing agreement with an IT service provider?
Short answer
Yes, if the provider processes personal data on your behalf — and access to the system holding that data already counts as processing. In that case you need a separate data processing agreement or a corresponding annex to the main contract.
On this page
1.When a provider is a processor
A provider is a processor when it processes data on your instructions and for your purposes: maintaining servers, administering the mail system, running a CRM, providing bookkeeping services, maintaining video surveillance equipment. It does not matter whether it reads the data every day — what matters is that it can access it while performing the contract.
It is different when the provider uses the data for its own purposes and decides for itself how to process it: then it is a separate controller, and the relationship needs to be described differently. It is worth establishing this distinction before signing, because the whole structure of the agreement depends on it.
2.What the agreement must cover
The agreement states the subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects. Next come the provider's obligations: to process data only on documented instructions, to maintain confidentiality, to apply security measures, to help you respond to individuals' requests, and to notify you of breaches without delay.
Sub-processors are addressed separately: whether they are permitted, how you are notified of them, and whether you can object. And finally, what the provider does with the data once the agreement ends: returns or destroys it, within what timeframe, and how it confirms this. For the mandatory content of the agreement, see Article 28(3) GDPR.
3.Check whether you already have an agreement
Often the data processing terms already sit in an annex to the main contract or in the provider's general terms — nobody just remembers them. Before drafting a new document, review the contract you already have and the terms published on the provider's website.
If the terms exist, check whether they match reality: whether they list the types of data the provider actually sees, whether sub-processors are named, and whether the fate of the data once the agreement ends is described. An agreement that formally exists but is inaccurate protects you less than it appears to.
4.How to keep track of your providers
The simplest way is a list of providers in the record: name, service, what data it sees, whether an agreement is signed, and whether the data leaves the European Economic Area. Such a list immediately shows the gaps and speeds up answering audit questions considerably.
The list is worth reviewing once a year and every time a new system is introduced. A new piece of software almost always means a new provider, and a new provider means a new agreement — or at least checking for one.
Official legal text
We do not paraphrase the regulation's provisions here. The official Lithuanian text of the GDPR is available in one place and is more precise than any summary.
GDPR text in Lithuanian (EUR-Lex)