What is a data processing agreement?
A data processing agreement (DPA; in German “AV-Vertrag”) governs how a service provider processes personal data on your behalf. The basis is Art. 28 GDPR. You remain the controller and decide what happens to the data; the provider is the processor and may only use it on your instructions.
Art. 28 (3) GDPR sets out what it must contain at least:
- Subject matter and duration, nature and purpose of processing, types of data and categories of data subjects
- Processing only on documented instructions
- Confidentiality of the people who have access
- Technical and organisational measures under Art. 32 GDPR
- Rules for further service providers (subprocessors)
- Assistance with data subject requests and personal data breaches
- Deletion or return of the data after the end of the contract
- Proof and audits
The agreement may be concluded electronically (Art. 28 (9) GDPR). No paper or signature is needed.
When do you need a DPA?
As soon as you use cloud storage to keep personal data of other people for work. Typical examples:
- Quotes, invoices and contracts with your clients’ names and addresses
- Findings and reports in a practice, briefs in a law firm, receipts at a tax adviser’s office
- Applications and personnel files, even if you only employ one assistant
- Photos and project files in which clients can be recognised
This applies regardless of size: also to sole traders, freelancers and small offices. You do not need a DPA for purely private files – the GDPR does not apply to purely personal or household activities (Art. 2 (2) (c) GDPR). That is why SafeDoc’s free plan, intended for private use, has no DPA.
This is general guidance, not legal advice.
What SafeDoc offers
| Question | At SafeDoc | Status |
|---|---|---|
| For whom? | Every paid plan from Plus – for individuals too, not only from a minimum number of users. | Built · launches with paid plans |
| Where? | In your account under Settings → Agreements. | |
| Organisations | Owners and admins conclude it in the organisation. | Built · launches with Business plans |
| Read first | The full wording can be read in every account, including the free one. | |
| Proof | Version, checksum of the wording, your details, who accepted and when are stored. Save it as PDF or HTML. | |
| Language | The agreement is in German; the German wording is binding. |
There is no extra charge: the DPA is included in the plan.
How to conclude it
- Create an account and choose a paid plan (from Plus).
- Open Settings → Agreements in your account.
- Enter your name or company, address and representative and read the wording.
- Confirm that you have read the agreement and click “Conclude agreement”.
- Save the agreement as PDF or HTML and keep it with your records.
Technical and organisational measures
Section 5 of the agreement lists these measures under Art. 32 GDPR:
- Encrypted transfer (HTTPS/TLS)
- Passwords only as Argon2id hashes; two-factor sign-in via app
- Permission check on the server for every access; clients separated by their own storage areas; short-lived download addresses
- Brakes against password guessing; a log of important actions such as shares, role changes and deletions
- Files and database are stored in data centres in Germany. Backups are also planned for Germany; they are being set up right now.
We do not use the contents of your files to train AI models and do not pass them on to providers of AI services. This is in the agreement too. More on the measures and their status is on the security page.
Subprocessors
The service providers we use are listed publicly, with history, on the subprocessors page. We announce new or changed subprocessors at least 30 days in advance. You can object for an important data protection reason. Every subprocessor is contractually bound to the same data protection obligations.
For professionals bound by secrecy: Section 203 StGB as well
Doctors, lawyers, tax advisers and other professions bound by secrecy need, in addition to the DPA, a commitment by the provider to confidentiality (Section 203 (4) StGB). The confidentiality agreement under Section 203 StGB can be concluded from launch. Before that, we bind everyone involved in our service to confidentiality in text form – only then do we offer it. You can already read the wording in your account under Settings → Agreements.
Everything about this is on the page For professionals bound by secrecy.
What the DPA does not replace
The agreement governs the relationship between you and SafeDoc. Your own duties as controller remain: a legal basis for the data, information for the people concerned and, where required, a record of processing activities. How to pass on client data safely is shown in the article Sharing client data under the GDPR; what to look for when choosing storage, in the checklist for freelancers.