Blog/Compliance
Compliance · 10 Apr 2026 · 7 min

Data processing agreements: what has to be in one and how to get it signed

If a supplier touches your customers' personal data, Article 28 requires a contract with specific contents. Here is what it must contain, who needs one, and the three clauses worth reading before you sign.

The contract that has to exist before the data moves

You are the controller of your customers' data. Every tool you hand it to — the email platform, the analytics, the helpdesk, the hosting — is a processor acting on your instructions. Article 28 says that relationship must be governed by a contract, and it specifies what the contract has to say.

This is not optional paperwork and it is not something the supplier does you a favour by providing. Without it, the transfer of data to that supplier has no lawful footing.

What Article 28 requires it to contain

A DPA is not free-form. It must set out, at minimum:

  1. Subject matter, duration, nature and purpose of the processing.
  2. The type of personal data and the categories of data subject.
  3. That the processor acts only on documented instructions from you.
  4. That staff are under a duty of confidentiality.
  5. Security measures under Article 32.
  6. Terms for engaging sub-processors — authorisation, and notice of changes.
  7. Assistance with data subject requests and with breach notification.
  8. Deletion or return of the data at the end of the contract.
  9. That the processor makes available the information needed to demonstrate compliance, and allows audits.

If a supplier's document is missing several of these, it is a marketing page with the word agreement at the top.

Which of your suppliers need one

The test is not how important the tool feels. It is whether personal data reaches it.
  • Email and SMS platforms — obviously.
  • Hosting and CDN, including your WordPress host.
  • Analytics, including anything that sets an identifier.
  • Helpdesk, reviews, live chat.
  • Payment providers — usually controllers in their own right for fraud and compliance purposes, which changes the shape of the contract rather than removing the need for one.
  • Freelancers and agencies with access to any of the above.

Keep a list. Not because a regulator will ask for it first, but because when somebody does ask, the shops that have it answer in an hour and the shops that do not spend a fortnight discovering tools they forgot about.

Every tool holding your customer data needs one of these on file
Every tool holding your customer data needs one of these on file

The three clauses worth actually reading

  1. Sub-processors. Look for the list, and for how you are notified of changes. "We may update this list from time to time" with no notice period means you cannot meet your own transparency obligations.
  2. International transfers. If data leaves the EEA, the contract needs a transfer mechanism — standard contractual clauses, an adequacy decision, or a certification framework. Check which, and check it is current rather than referencing something superseded.
  3. Deletion on termination. Look for a stated period and for what "deletion" means where backups are concerned. "Deleted within 90 days, backups expire within a further 30" is honest. Silence is not.

How to get it signed without a legal department

Most suppliers publish a standard DPA that you accept online or countersign. That is normal and fine. The practical process:

  1. Find the supplier's DPA — usually linked from their terms or a trust page.
  2. Read the three clauses above. Skim the rest against the Article 28 checklist.
  3. Accept or sign, and save a dated copy. A link is not a record; the page will change.
  4. Record it in your processing register alongside what data the tool gets and why.

Where a supplier has no DPA at all and will not produce one, that is your answer about the supplier.

The register is the part that pays off

Article 30 requires most organisations to keep records of processing activities. For a shop this is a spreadsheet, not a project: one row per tool, with what data it receives, why, where it is stored, which DPA governs it and when you last checked.

It takes an afternoon to build and it is the document that turns a data subject access request, a breach, or a supplier migration from a panic into a task.

Sources and further reading (4)
  1. GDPR Article 28 — Processor
  2. GDPR Article 30 — Records of processing activities
  3. EDPB — Guidelines 07/2020 on controller and processor concepts
  4. European Commission — Standard contractual clauses

Checked on 23 September 2026. Provider prices, mailbox rules and legal guidance change — verify anything you plan to act on.

One processor, documented

A DPA you can actually put in the folder

Auralata publishes its data processing terms as part of its agreement, names its sub-processors, and deletes a store's data when you remove it — so the row in your register takes a minute to fill in.

Start now See how it works
Processing registerone row per tool
Data receivedorders, emails
Stored inEU
DPA on fileyes
Deleted with the store, on request, in full.
More from the blog

Everything else we have written down.

Leaving Klaviyo: what actually moves, what has to be rebuilt, and what you lose Migration · 11 min Leaving Klaviyo: what actually moves, what has to be rebuilt, and what you lose Profiles, consent, suppressions, lists, segments and events come across through the API. Flows do not, and neither does your sending reputation. The honest inventory, endpoint by endpoint. Ecommerce SEO: the four things that compound, and the rest that does not SEO · 8 min Ecommerce SEO: the four things that compound, and the rest that does not Product data, structured markup, one canonical page per product and copy a person would actually read. Everything else is a rounding error on a catalogue of a thousand items. Gmail clips your email at about 102 kB. Here is what it costs you. Deliverability · 7 min Gmail clips your email at about 102 kB. Here is what it costs you. The unsubscribe link, the tracking pixel and half your products end up behind a “View entire message” link. The fix is boring and takes ten minutes. An email opt-in is not an SMS opt-in, and it is definitely not a WhatsApp opt-in Compliance · 8 min An email opt-in is not an SMS opt-in, and it is definitely not a WhatsApp opt-in Four channels, four legal bases, one checkout form. What you can reuse, what you have to ask for again, and what auditors look at first. The bulk sender rules are not new any more. Most shops still fail one of them. Deliverability · 8 min The bulk sender rules are not new any more. Most shops still fail one of them. SPF, DKIM, DMARC, one-click unsubscribe and a complaint rate under 0.3 %. A checklist you can finish this afternoon, and the one item that quietly breaks later. The abandoned cart flow that does not sound desperate Flows · 7 min The abandoned cart flow that does not sound desperate Three messages, one discount at most, and a condition that checks whether they already bought. Plus the legal detail most shops get wrong about cart reminders. The open rate has been broken since 2021. Here is what to report instead. Measurement · 7 min The open rate has been broken since 2021. Here is what to report instead. Apple's Mail Privacy Protection pre-loads your tracking pixel whether or not anyone read the message. Four metrics that survived, and one that got more important. WhatsApp now charges per message, not per conversation. Budget accordingly. Channels · 7 min WhatsApp now charges per message, not per conversation. Budget accordingly. The 24-hour conversation window stopped being the billing unit in July 2025. What changed, what is still free, and when a WhatsApp campaign beats an email. AI product images: generate the scene, never the product Content · 8 min AI product images: generate the scene, never the product Generated backgrounds are fine and legal. Generated labels, generated fabric and generated features are a returns problem and, since August 2026, a disclosure problem. Segments that survive contact with a real catalogue Audiences · 7 min Segments that survive contact with a real catalogue Six definitions that still work when the shop has 1,200 products, half of them seasonal, and someone renames a category on a Tuesday. Your customer list is still the best ad audience. It is just harder to upload now. Advertising · 7 min Your customer list is still the best ad audience. It is just harder to upload now. Consent Mode v2, hashed matching and server-side events, explained for people who have to run the campaign rather than argue about it. Never send marketing and receipts from the same subdomain Infrastructure · 6 min Never send marketing and receipts from the same subdomain One bad campaign should not stop order confirmations from arriving. Separating the two takes an afternoon and is the cheapest insurance in email. The welcome series is the only flow that pays for itself in week one Flows · 7 min The welcome series is the only flow that pays for itself in week one Three emails to people who have just decided they are interested in you. What goes in each, why the first one should not sell, and the two mistakes that waste the best audience you will ever have. Browse abandonment is not cart abandonment, and sending the same email costs you both Flows · 7 min Browse abandonment is not cart abandonment, and sending the same email costs you both A cart is an interrupted decision; a browse is an open question. The email that recovers one reads as surveillance when you send it for the other. Timing, wording and the threshold worth having. The second order is the one that matters. A post-purchase flow that earns it. Flows · 8 min The second order is the one that matters. A post-purchase flow that earns it. Most shops say nothing for a fortnight after an order, then ask for a review on day two. What to send between delivery and the second purchase, and why the timing comes from your own data. Win-back flows: what to send at 90 days, 180 days and never Flows · 7 min Win-back flows: what to send at 90 days, 180 days and never A lapsed customer is not a prospect. Three tiers by how long they have been gone, why the discount belongs last rather than first, and the point at which stopping beats escalating. Replenishment reminders: the right day is already in your order table Flows · 7 min Replenishment reminders: the right day is already in your order table If you sell anything that runs out, the best automation you own is a reminder timed to when it runs out. How to compute the interval per product from real repeat orders, and what to do when it is bimodal. RFM segmentation for ecommerce: how to build it without a spreadsheet Audiences · 7 min RFM segmentation for ecommerce: how to build it without a spreadsheet RFM needs three fields you already have. How to score customers, why four groups beat 125 cells, and the message each group should get — without exporting anything to a spreadsheet. Sending from a new domain: how to get the first thousand emails delivered Deliverability · 7 min Sending from a new domain: how to get the first thousand emails delivered A new sending domain has no reputation, and mailbox providers treat that closer to bad than good. Authentication, the first audience, volume ramp, and the three signals that decide the next hundred thousand. Double opt-in in the EU: when it is required and how to implement it Compliance · 8 min Double opt-in in the EU: when it is required and how to implement it The GDPR never says "double opt-in", but several national regulators effectively require it. Where it is expected, where single opt-in holds up, and how to build a record that survives a complaint. SMS marketing in Europe: what it costs and how to launch it properly Channels · 7 min SMS marketing in Europe: what it costs and how to launch it properly Sender IDs are registered per country, opt-out handling is mandatory, and the price per message varies more than tenfold across the EU. The practical checklist before your first campaign. Product photography for AI: how to shoot images a model can work from Content · 7 min Product photography for AI: how to shoot images a model can work from The source photo decides almost everything about a generated lifestyle image. What to shoot, how to light it, and the four mistakes that make a product impossible to place convincingly. Revenue per recipient: how to calculate it and why it beats open rate Measurement · 7 min Revenue per recipient: how to calculate it and why it beats open rate One number that compares a campaign to a flow to a channel. What to include, what to exclude, the attribution window it depends on, and the two variants worth reporting beside it. Customer match after consent mode: how to keep uploading audiences lawfully Advertising · 7 min Customer match after consent mode: how to keep uploading audiences lawfully Your customer list is still the strongest ad audience you own. What consent mode changed, why hashing is not anonymisation, and how to keep uploads lawful without shrinking the audience to nothing. Lost webhooks: how to catch the drift with a nightly reconcile Infrastructure · 7 min Lost webhooks: how to catch the drift with a nightly reconcile WordPress will drop a hook eventually, and nothing errors when it does. Why webhooks alone are never enough, how to build a nightly checksum reconcile, and the three bugs that make it lie to you. Migrate from Mailchimp: what it takes and how to do it Migration · 8 min Migrate from Mailchimp: what it takes and how to do it Contacts and tags export cleanly; consent history, automations and sending reputation do not. What actually moves, what has to be rebuilt, the order to do it in, and how to avoid a deliverability cliff. Product page SEO: how to earn a second visit from search SEO · 7 min Product page SEO: how to earn a second visit from search Most product pages are a photo, a price and the manufacturer's paragraph — the same page a hundred other shops have. What to add so it is worth ranking, in the order that pays back. Engagement gating: how to set it up and why it belongs at send time Audiences · 7 min Engagement gating: how to set it up and why it belongs at send time Filtering dormant addresses is the cheapest deliverability work available. Why the gate has to run at send time rather than at list build, what window to use, and how to exempt transactional mail correctly. SPF, DKIM and DMARC: how to set all three up and what each one stops Deliverability · 8 min SPF, DKIM and DMARC: how to set all three up and what each one stops Three DNS records explained by what breaks without each one. The ten-lookup limit that silently kills SPF, why DKIM needs a selector per service, and how to move DMARC to reject without losing mail. The WhatsApp 24-hour window: how it works and how to plan around it Channels · 7 min The WhatsApp 24-hour window: how it works and how to plan around it One clock, started by the customer, decides whether you may write freely or must use a pre-approved template. How the window works, what template approval involves, and how pricing follows from both. One photo into six formats: how to write a brief that holds Content · 7 min One photo into six formats: how to write a brief that holds Six surfaces, six framing problems, one source photo. How to write a format brief that produces all of them consistently — and the safe areas that decide whether the crop survives. Attribution windows: how to choose one and stick to it Measurement · 7 min Attribution windows: how to choose one and stick to it Seven days or thirty, click or view, last touch or first. Every answer is defensible; changing answers mid-year is not. How to pick a window, write it down, and read platform numbers against it. Product feeds for Google and Meta: how to keep price and stock honest Advertising · 7 min Product feeds for Google and Meta: how to keep price and stock honest A feed is a continuous promise that a product exists at that price and can be bought today. How often to refresh, which fields decide whether you rank, and the mismatches that get an account suspended. Idempotency for shop integrations: how to build it and why it is the whole contract Infrastructure · 7 min Idempotency for shop integrations: how to build it and why it is the whole contract Any system that retries will deliver the same event twice. How to choose an idempotency key, why a duplicate must answer success rather than 500, and the three places double-counting actually shows up. Move your sending domain: how to migrate without losing reputation Migration · 7 min Move your sending domain: how to migrate without losing reputation Reputation attaches to the domain and the IP, and neither transfers. Why to change one thing at a time, how to split traffic during the move, and the DNS record that must be removed afterwards. Product structured data: how to implement it so it matches the page SEO · 7 min Product structured data: how to implement it so it matches the page Markup tells search engines what a page means. Which properties matter, why price and availability must match the visible page, and the review markup that earns a manual action. Segment size and revenue: how to find the smaller list that earns more Audiences · 7 min Segment size and revenue: how to find the smaller list that earns more The instinct before a big campaign is to widen the audience. How to test the opposite on your own data, why revenue per recipient falls as the list grows, and where the real ceiling sits. Spam traps: how they get onto a clean list and how to get them off Deliverability · 7 min Spam traps: how they get onto a clean list and how to get them off A spam trap is an address that could not possibly have consented. The three kinds, how each arrives on an otherwise clean list, and why deleting them is not how you fix the problem. One-click unsubscribe: how to implement RFC 8058 and stay compliant Compliance · 7 min One-click unsubscribe: how to implement RFC 8058 and stay compliant Two headers and an endpoint, required by Google and Yahoo for bulk senders. What to send, what the endpoint must do, the two-day rule, and why the footer link still has to exist. Viber or WhatsApp: how to choose for a European shop Channels · 7 min Viber or WhatsApp: how to choose for a European shop The answer is mostly geography and partly pricing. How to find out which app your customers actually use, what each costs, and why running both is usually worse than running one well. Email subject lines: how to write ones that survive the preview pane Content · 7 min Email subject lines: how to write ones that survive the preview pane A subject is read in about forty characters beside a preheader you probably did not write. What survives the preview pane, how to use the preheader properly, and why most A/B tests prove nothing. Holdout groups: how to run one and what it will tell you Measurement · 7 min Holdout groups: how to run one and what it will tell you Attribution tells you which message a buyer saw last; a holdout tells you whether it changed anything. How to size one, where to run it permanently, and how to read a result that comes back at zero. Retargeting with a shrinking pool: how to keep it working Advertising · 7 min Retargeting with a shrinking pool: how to keep it working Consent banners and browser restrictions have cut retargetable audiences to a fraction of site traffic. What still works, why first-party segments outperform pixel pools, and when to stop spending on it. Storing prices with tax and currency: how to get totals right for every shop Infrastructure · 8 min Storing prices with tax and currency: how to get totals right for every shop A number in a price column means nothing alone. Why currency, tax inclusion, rate and shipping must each be stored, and the four calculations that go wrong when any of them is assumed. Rebuilding flows after a migration: how to recreate what will not export Migration · 7 min Rebuilding flows after a migration: how to recreate what will not export Automations have no useful export format. What to document before you lose access, the order to rebuild in, and why exit conditions matter more than the copy you are worried about. Faceted navigation and crawl budget: how to stop wasting it SEO · 7 min Faceted navigation and crawl budget: how to stop wasting it Three filters with four values each produce more URLs than most shops have products. How to decide which facets deserve indexing, and the four controls that stop the rest eating your crawl budget. Lookalike audiences: how to pick a seed that actually works Audiences · 7 min Lookalike audiences: how to pick a seed that actually works The platform's model is rarely the problem; the seed is. How to choose one, why a smaller high-value seed beats your whole customer list, and how often to refresh it. Domain warm-up: how to ramp sending volume week by week Deliverability · 7 min Domain warm-up: how to ramp sending volume week by week A concrete four-week ramp, what to check before each increase, and the hold rule that matters more than the schedule itself. Plus why consistency beats volume for a new sender. Proof of consent: how to record it so it holds up with a regulator Compliance · 7 min Proof of consent: how to record it so it holds up with a regulator Article 7 puts the burden on you to demonstrate consent was given. What a defensible record contains, how to version the wording, how long to keep it, and what to do about consents you inherited. Push notifications for ecommerce: when to use them and how to write them Channels · 7 min Push notifications for ecommerce: when to use them and how to write them Web push is cheap, instant, and the fastest permission to lose for ever. What it is actually good for, how to ask for the permission, and the frequency that quietly destroys the channel. Alt text for email and ecommerce: how to write it and why it is read first Content · 7 min Alt text for email and ecommerce: how to write it and why it is read first Many inboxes block images by default, making alt text the first thing read. How to write it for products, decorative images and image-only emails, and the mistakes that make it useless. Ecommerce analytics: how to count people instead of clicks Measurement · 7 min Ecommerce analytics: how to count people instead of clicks A visitor who refreshes ten times is one visitor. Why session-based metrics mislead, the four numbers worth reporting, and how to handle the traffic that consent rules make invisible. Conversions API: what it fixes, what it does not, and how to set it up Advertising · 7 min Conversions API: what it fixes, what it does not, and how to set it up Server-side events recover measurement that ad blockers and browser limits removed. What they genuinely fix, why deduplication matters, and why this is not a route around a visitor's refusal. Sync lag: how to find out your data is an hour behind, and fix it Infrastructure · 7 min Sync lag: how to find out your data is an hour behind, and fix it Stale data does not announce itself — everything renders and every number looks plausible. How to measure real end-to-end lag, the three causes worth checking first, and what to put on screen. Running two marketing tools at once: how to plan the overlap Migration · 7 min Running two marketing tools at once: how to plan the overlap The fortnight where both platforms are live is cheap insurance and an easy way to send everything twice. What to switch when, the three rules that prevent duplicates, and how to compare fairly. Category page SEO: how to make them the pages that rank SEO · 7 min Category page SEO: how to make them the pages that rank People search for the category and buy from the product. Why category pages carry the ranking, what copy belongs on them, and how to handle pagination, sorting and thin categories. Profile merging across devices: how identity resolution actually works Audiences · 7 min Profile merging across devices: how identity resolution actually works A phone and a laptop are two records until something connects them. What the identifiers are, what should happen at the moment of a merge, and why creating the profile early is the whole point. Bounce handling: how to tell a soft bounce that should be treated as hard Deliverability · 7 min Bounce handling: how to tell a soft bounce that should be treated as hard A hard bounce is permanent and a soft bounce is temporary — until you meet the ones that repeat for ever. How to classify by code and by repetition, and the retry schedule that stops the damage. Data retention for ecommerce: how long to keep customer data and how to delete it Compliance · 7 min Data retention for ecommerce: how long to keep customer data and how to delete it There is no single retention period, because different data has different clocks. How to set one per category, why deletion means anonymisation for orders, and what a deletion request actually requires. Choosing a channel per message: a framework that holds up Channels · 7 min Choosing a channel per message: a framework that holds up Email, SMS, WhatsApp and push have different costs, permissions and tolerances for interruption. Three questions that decide where a message belongs, and a table of the common cases. AI product images: when to use them and when not to Content · 7 min AI product images: when to use them and when not to Generating a background is ordinary image editing at scale. Generating the product, or a claim about it, is not. Where the line sits, what EU rules require, and the four checks before publishing. Reconciling ad platform numbers: why they never match and what to trust Measurement · 7 min Reconciling ad platform numbers: why they never match and what to trust Meta says 340, Google says 210, your shop recorded 402 orders total. Five structural reasons they disagree, which number to plan with, and the ratio worth tracking instead. Splitting ad budget without reliable attribution: how to decide Advertising · 7 min Splitting ad budget without reliable attribution: how to decide Attribution got worse and is not coming back. How to allocate budget using holdouts, marginal tests and a stable baseline rather than waiting for a number you will never have. Time zones in reporting: how to stop them breaking one report a quarter Infrastructure · 7 min Time zones in reporting: how to stop them breaking one report a quarter A day is not a fixed thing. Where to store times, where to convert them, why scheduled sends need the shop's clock, and the daylight-saving cases that break a report twice a year. After a migration: what to check on day one Migration · 7 min After a migration: what to check on day one Most migration problems that become expensive were visible on day one. A checklist in priority order, the two numbers to watch for a fortnight, and what to keep before cancelling anything. Ecommerce blog strategy: which posts to write and which to skip SEO · 7 min Ecommerce blog strategy: which posts to write and which to skip Most shop blogs are company news and seasonal filler. The four kinds of post that earn traffic which converts, the three that never do, and how to link them to the products. Back-in-stock alerts: how to build the flow and what it is worth Flows · 12 min Back-in-stock alerts: how to build the flow and what it is worth A back-in-stock request is the clearest purchase intent a shop ever receives. How to capture it, how fast the alert has to be, how to handle variants and thin restocks, how to write it, and the demand signal it hands your buyer. Review requests: how to ask so people actually answer Flows · 12 min Review requests: how to ask so people actually answer Reviews are the cheapest high-converting content a shop can produce. When to ask, why one specific question beats a star widget, what to do with bad reviews, what EU law now requires, and how to get the value back out. VIP customers: how to identify them and what to actually do for them Flows · 12 min VIP customers: how to identify them and what to actually do for them Most shops define VIPs by lifetime spend and reward them with the discount everyone gets. How to define the group so it stays current, why recognition outperforms discounting, the entry message, and how to handle people falling out.