Data Processing Agreement in France: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) in France is the written contract required whenever one business (the processor) handles personal data on behalf of another (the controller). It is not optional. Article 28(3) of the GDPR makes a written contract a legal condition of using a processor, and the CNIL, France's data protection authority, enforces it directly. In 2022 the CNIL fined a processor 1.5 million euros partly for failing to have a compliant Article 28 contract and for processing beyond its client's instructions, confirming that a processor can be liable on its own account. This page explains what a French DPA must contain, the local-law layer on top of the GDPR, and a simple outline. It is general information, not legal advice. ## Why a DPA is required in France France applies the GDPR (Regulation 2016/679) alongside its national law, the amended Law No. 78-17 of 6 January 1978 (Loi Informatique et Libertes), updated to align with the GDPR. The CNIL supervises, investigates and fines. Under Article 28(3), any controller-to-processor arrangement must be governed by a contract that binds the processor to act only on documented instructions and sets out defined obligations. The CNIL has published a guide for processors with model clauses, so there is a clear local benchmark for what a French DPA should look like. ## Mandatory content under Article 28(3) The GDPR fixes the minimum content. A French DPA must state: - the subject matter and duration of the processing;

• the nature and purpose of the processing;
• the type of personal data and categories of data subjects;
• the controller's rights and obligations. It must also bind the processor to the eight lettered duties in Article 28(3): 1. process only on documented instructions, including on international transfers;

2. ensure persons authorised to process are under confidentiality;
3. take security measures under Article 32;
4. respect the conditions for engaging a sub-processor;
5. assist the controller in responding to data subject requests;
6. assist with security, breach notification and impact assessments (Articles 32 to 36);
7. delete or return the data at the end of the service;
8. make available the information needed to show compliance and allow audits. ## Key clauses to get right in France ### Instructions and purpose limitation The CNIL's enforcement shows that going beyond the controller's instructions is itself a breach. Write the permitted purposes tightly and require written change instructions. ### Sub-processors Set whether sub-processors need prior specific or general written authorisation, require flow-down of the same obligations, and keep the processor liable for its sub-processors. ### Security measures Reference Article 32 and attach a schedule of technical and organisational measures (encryption, access control, logging). Keep it specific; vague security language is discounted. ### International transfers For data leaving the EEA, rely on the European Commission's standard contractual clauses (Decision 2021/914) and, where needed, a transfer impact assessment. Name the mechanism in the DPA. ### Breach notification The controller must notify the CNIL within 72 hours of becoming aware of a reportable breach (Article 33). Require the processor to notify the controller without undue delay, and set a short internal window. ### Audit and records Give the controller audit and information rights, and require the processor to keep records of processing under Article 30. ### Return or deletion on exit Specify whether data is returned or deleted at the end, in what format, and within what period. ## A simple French DPA outline 1. Parties, roles and definitions
9. Subject matter, nature, purpose and duration
10. Categories of data and data subjects (annex)
11. Processing only on documented instructions
12. Confidentiality of personnel
13. Security measures (Article 32 and TOMs annex)
14. Sub-processors and authorisation
15. International transfers and the chosen mechanism
16. Assistance with data subject rights and Articles 32 to 36
17. Breach notification timing
18. Audit, records and demonstrating compliance
19. Return or deletion of data on termination ## Common mistakes to avoid - Treating the DPA as a formality and copying a template that omits one of the eight Article 28(3) duties.

• Allowing the processor to act beyond documented instructions, which the CNIL has fined on its own.
• No clear transfer mechanism for data leaving the EEA.
• A vague security annex instead of specific technical and organisational measures. ## Keeping processor terms aligned across the business DPAs multiply fast: one per vendor, each with its own sub-processor list, transfer mechanism and security annex, and they drift out of step with the main service contract. Holding each DPA next to its parent agreement in one workspace, with the Article 28 checklist, sub-processor lists and breach-notice windows visible and tracked, makes it far easier to show the CNIL a consistent position. Adira is one AI workspace to draft, review, track and govern contracts this way; its non-India jurisdiction depth is on its roadmap, so verify French coverage before relying on it for a France matter. More at Adira.