What is a data processing agreement under Dutch law?

Dutch term: Verwerkersovereenkomst | Legal basis: Article 28 GDPR

A data processing agreement (verwerkersovereenkomst) under Dutch law is a mandatory contract between a data controller and a data processor, required by article 28 of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). It governs the processor's handling of personal data on behalf of the controller.

The agreement must specify the subject matter, duration, nature and purpose of the processing, the type of personal data, the categories of data subjects, the controller's instructions, the processor's obligations regarding security, sub-processing, data breach notification, data subject rights assistance, and the return or deletion of data on termination.

Why it matters for international businesses

For any B2B relationship involving the processing of personal data (cloud services, SaaS, outsourcing, logistics), a GDPR-compliant data processing agreement is legally required. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority) actively enforces this requirement.