Data Processing Agreement in Netherlands: Template, Key Clauses and Local Law (2026)

A data processing agreement in the Netherlands, known as a verwerkersovereenkomst, is the written contract required whenever one business (the processor, verwerker) handles personal data on behalf of another (the controller, verwerkingsverantwoordelijke). It is mandatory. Article 28(3) of the GDPR makes a written contract a legal condition of using a processor, and in the Netherlands the GDPR applies alongside the national implementing act, the Uitvoeringswet AVG (UAVG). The supervisory authority is the Autoriteit Persoonsgegevens (AP). This page explains what a Dutch DPA must contain, the local layer on top of the GDPR, and a simple outline. It is general information, not legal advice. ## Why a verwerkersovereenkomst is required In Dutch the GDPR is the Algemene Verordening Gegevensbescherming (AVG). The UAVG sets out national choices such as the AP's powers and some exemptions, but the core processor-contract rules come straight from Article 28 of the GDPR. Without a compliant contract, the processing has no lawful basis for the controller-processor relationship, and both parties are exposed to AP enforcement. ## Mandatory content under Article 28(3) A Dutch DPA must set out: - the subject matter and duration of the processing;

• the nature and purpose of the processing;
• the type of personal data and categories of data subjects;
• the controller's rights and obligations. It must also bind the processor to the eight lettered duties in Article 28(3): 1. process only on documented instructions from the controller, including on transfers;

2. ensure that authorised persons are bound by confidentiality;
3. take the security measures required by Article 32;
4. respect the rules on engaging another processor (sub-processor);
5. help the controller respond to data subject requests;
6. assist with security, breach notification and data protection impact assessments (Articles 32 to 36);
7. delete or return the data at the end of the service;
8. make available the information needed to show compliance and allow audits. ## Key clauses to get right in the Netherlands ### Instructions and purpose The processor acts only on documented instructions. Keep the permitted purpose tight and require written change instructions. ### Sub-processors State whether prior specific or general written authorisation is needed, require the same obligations to flow down, and keep the processor liable for its sub-processors. ### Security measures Reference Article 32 and attach a schedule of technical and organisational measures. Dutch practice expects specifics, not generic language. ### International transfers For data leaving the EEA, name the mechanism, usually the European Commission's standard contractual clauses under Decision 2021/914, and carry out a transfer impact assessment where needed. ### Breach notification The controller must notify the AP within 72 hours of becoming aware of a reportable breach (Article 33). Require the processor to notify the controller without undue delay; a short fixed internal window is common Dutch practice. ### Audit and records Give the controller audit and information rights, and require records of processing under Article 30. ### Return or deletion on exit Specify whether the data is returned or deleted at the end of the service, in what format and within what period. ## A simple Dutch DPA outline 1. Parties, roles and definitions
9. Subject matter, nature, purpose and duration
10. Categories of data and data subjects (annex)
11. Processing only on documented instructions
12. Confidentiality of personnel
13. Security measures (Article 32 and the measures annex)
14. Sub-processors and authorisation
15. International transfers and the chosen mechanism
16. Assistance with data subject rights and Articles 32 to 36
17. Breach notification timing
18. Audit, records and demonstrating compliance
19. Return or deletion of data on termination ## Common mistakes to avoid - Copying a template that drops one of the eight Article 28(3) duties.

• Letting the processor act beyond documented instructions.
• No named transfer mechanism for data leaving the EEA.
• A vague security annex rather than specific technical and organisational measures. ## Keeping processor terms aligned across the business DPAs pile up, one per vendor, each with its own sub-processor list, transfer mechanism and security annex, and they drift out of step with the underlying service contracts. Holding each verwerkersovereenkomst next to its parent agreement in one workspace, with the Article 28 checklist, sub-processor lists and breach-notice windows visible and tracked, makes it far easier to show the AP a consistent position. Adira is one AI workspace to draft, review, track and govern contracts this way; its non-India jurisdiction depth is on its roadmap, so verify Dutch coverage before relying on it for a Netherlands matter. More at Adira.