# Data Processing Clause

Source: https://contracko.com/pt/biblioteca-de-clausulas/tratamento-de-dados

# Data Processing Clause

Governs how a processor handles personal data for a controller, as required by GDPR Article 28.

## O que é

A data processing clause or agreement (DPA) sets the controller-processor terms required by GDPR Article 28: subject matter, duration, instructions, security measures, sub-processing, breach notification and deletion. It is mandatory whenever one party processes personal data on another's behalf.

## Porque é importante

Without a compliant DPA, both parties breach the GDPR and risk fines and liability for data subjects' claims. The clause allocates security duties and breach-notification timing, which is critical when a data incident occurs.

## Como aplicar

- Document the nature, purpose, duration and categories of data and data subjects.
- Require processing only on documented instructions and appropriate security measures.
- Set sub-processor approval, breach-notification timing and audit rights.
- Address international transfers with an appropriate safeguard (e.g. SCCs).

## Exemplo de redação

> The Processor shall process Personal Data only on the Controller's documented instructions, implement appropriate technical and organisational measures, and notify the Controller without undue delay of any personal data breach.

## Dicas de negociação

- • Controllers should require prompt breach notice (e.g. within 24 to 48 hours) and audit rights.
- • Processors should pre-list approved sub-processors and use a change-notification mechanism.

## Erros frequentes

- • Treating the DPA as optional boilerplate rather than a mandatory GDPR requirement.
- • Ignoring international transfer safeguards when the processor sits outside the EEA.

### Como o Contracko ajuda

Contracko's AI review extracts data processing clauses from your vendor and SaaS contracts and flags any that are missing a sub-processor list, audit rights or breach-notification deadline. All DPAs are held in a central, searchable repository so your privacy team can quickly confirm coverage and locate specific agreements during a supervisory authority audit or a data incident.

## Referências jurídicas

- [GDPR Art. 28 GDPR: processor obligations Direito da UE](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- Dutch GDPR Implementation Act (Uitvoeringswet AVG)

Salvo indicação em contrário, as referências remetem para o direito neerlandês (Burgerlijk Wetboek, o Código Civil neerlandês); os instrumentos da UE, como o RGPD, aplicam-se em toda a UE. Esta é informação geral, não constitui aconselhamento jurídico. Outras jurisdições tratam estes conceitos de forma diferente. Verifique o texto em vigor e a sua situação com um advogado qualificado.

## Relevante para

[Software & SaaS](https://contracko.com/pt/setores/software-saas)[Empresas de IA e Dados](https://contracko.com/pt/setores/ia-dados)[Saúde](https://contracko.com/pt/setores/saude)[Serviços Financeiros](https://contracko.com/pt/setores/servicos-financeiros)[Prestadores de Serviços Geridos](https://contracko.com/pt/setores/fornecedores-servicos-geridos)

## Cláusulas relacionadas

- [Confidentiality Clause](https://contracko.com/pt/biblioteca-de-clausulas/clausula-de-confidencialidade)
- [Limitation of Liability Clause](https://contracko.com/pt/biblioteca-de-clausulas/limitacao-de-responsabilidade)
- [Indemnification Clause](https://contracko.com/pt/biblioteca-de-clausulas/clausula-de-indemnizacao)

## Termos relacionados

- [Data processing agreement (DPA)](https://contracko.com/pt/glossario/acordo-de-tratamento-de-dados)
- [GDPR](https://contracko.com/pt/glossario/rgpd)
- [Confidential information](https://contracko.com/pt/glossario/informacao-confidencial)

### Nunca mais perca um prazo contratual

- A IA encontra as datas de renovação e aviso prévio
- Os riscos e obrigações são apresentados automaticamente
- Os lembretes ajudam-no a agir antes que as datas passem

Largue um contrato para começar

PDF, DOCX, PNG ou JPG

[Iniciar avaliação de 7 dias](https://app.contracko.com/register?appLanguage=pt&utm_source=clause_library_sidebar&utm_medium=lead_magnet&utm_campaign=clause_library_sidebar_contract_upload&content_slug=data-processing&content_title=Data+Processing+Clause&cta_placement=clause_library_sidebar_cta&source_tool=clause_library_sidebar_data-processing)

Conforme com o RGPD. Encriptado. Nunca utilizado para treinar IA.

## Perguntas frequentes

Questões comuns sobre esta cláusula.

- **Q:** When is a data processing agreement required?
  **A:** Whenever one party processes personal data on behalf of another; GDPR Article 28 makes a written agreement mandatory for that controller-processor relationship.

- **Q:** How fast must a data breach be reported between the parties?
  **A:** The processor must notify the controller without undue delay; many DPAs fix a hard deadline (often 24 to 72 hours) so the controller can meet its own reporting duty.

- **Q:** Does a DPA need to be updated when a new sub-processor is added?
  **A:** Yes. The processor must inform the controller in advance and allow a reasonable objection period; simply updating a website list without prior notice may not satisfy the obligation.

- **Q:** Can a processor transfer data outside the EEA?
  **A:** Only with an appropriate safeguard such as Standard Contractual Clauses (SCCs), an adequacy decision or Binding Corporate Rules. The DPA should specify the transfer mechanism used.

- **Q:** What happens if a processor acts outside the controller's instructions?
  **A:** The processor may become an independent controller for that processing and bear full GDPR liability for it, including potential fines and data subject claims.

## Nunca mais perca uma cláusula arriscada

O Contracko revê automaticamente cada contrato em busca desta cláusula e das obrigações que cria.

[Iniciar período de experiência gratuito de 7 dias](https://app.contracko.com/register?appLanguage=pt)

Marcar demonstração