Privacy Policy and DPA: two building blocks, one goal
Why a privacy policy (Art. 13 GDPR) and a data processing agreement (Art. 28 GDPR) complement each other – and in what order you need them.
Privacy policy and data processing agreement (DPA) are frequently confused or considered interchangeable – yet they regulate two different legal relationships and usually complement each other.
Privacy policy: You inform your visitors
The privacy policy for website/app fulfills your information obligation towards the persons whose data you process (Art. 13 GDPR) – website visitors, app users, newsletter subscribers. It describes which services you actually use: hosting, contact forms, cookies, web analytics (e.g., Google Analytics 4, Matomo, Plausible), social media embeds, newsletters, payment service providers. The wizard specifically asks for the services actually used, instead of generating a wall of text with every theoretically conceivable component.
DPA: You regulate your relationship with service providers
The data processing agreement (DPA), on the other hand, regulates your relationship as the controller with a service provider that processes personal data on your behalf (Art. 28 GDPR) – such as an external hosting provider, an email marketing tool, or accounting software. Strictly speaking, without an effective DPA, this service provider is not permitted to process the data of your clients or website visitors at all.
The natural two-step funnel
Both building blocks complement each other legally and are usually needed together in practice:
- You first create the privacy policy in order to operate your website/app in a legally compliant manner at all.
- If you use service providers that process data on your behalf (which is almost always the case – hosting alone is sufficient), you additionally conclude the DPA with these service providers.
The privacy policy template therefore already explicitly points to the DPA as the next step in its legal text if you specify service providers with data access.
Important
Both templates are independent documents with different target audiences – the privacy policy does not replace a DPA and vice versa. For special categories of data (health data, biometric data), extensive tracking, or AI-supported profiling, we recommend additional legal review (Finding a lawyer).
Related topics: Creating contracts · How do I adapt and revise a contract? · Finding a lawyer
Was this article helpful?
