Data Processing Agreement in Spain: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) in Spain is the written contract required whenever one business (the processor) handles personal data on behalf of another (the controller). In Spain this is governed by the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD). Without a compliant DPA, the arrangement itself breaks the law, even if nothing goes wrong with the data. This guide explains what a Spanish DPA must contain and the local points to watch. It is general information, not legal advice. Confirm specifics with a Spanish-qualified data protection lawyer. ## What is a data processing agreement and when do you need one in Spain? A DPA is not a privacy policy and not a general confidentiality clause. It is the specific contract that Article 28 of the GDPR requires between a controller and a processor. You need one whenever a supplier processes personal data for you, for example: - A SaaS or cloud vendor hosting your customer or employee data.

• A payroll, marketing, support or analytics provider.
• An outsourcing partner that touches personal data in any way. If the supplier only receives data for its own purposes and decides how to use it, it may be a separate controller, not a processor, and a different arrangement applies. Classify the relationship before you pick the contract. ## Which laws govern a DPA in Spain? - GDPR Article 28 sets the backbone: a processor must act only on the controller's documented instructions and under a binding written contract with specific mandatory content.
• LOPDGDD (Organic Law 3/2018) is Spain's national data protection law. It supplements the GDPR and creates and empowers the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).
• AEPD guidance. The AEPD, alone and with the Catalan and Basque authorities, publishes practical guides on controller and processor relationships that are widely followed in Spain, though they are guidance rather than binding law. Breaches of Article 28 fall into the GDPR's higher fine tier, up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. ## What must a Spanish DPA contain? Article 28(3) GDPR requires the DPA to set out, at minimum: - The subject matter and duration of the processing.
• The nature and purpose of the processing.
• The types of personal data.
• The categories of data subjects.
• The controller's obligations and rights. It must then bind the processor to eight core duties: 1. Process only on the controller's documented instructions, including on international transfers.

2. Ensure that people authorised to process the data are under a duty of confidentiality.
3. Take appropriate security measures under Article 32 (such as encryption, access control and resilience).
4. Not engage another processor (a sub-processor) without the controller's prior specific or general written authorisation, and flow the same obligations down.
5. Assist the controller in responding to data-subject rights requests.
6. Assist the controller with security, breach notification and data protection impact assessments under Articles 32 to 36.
7. Delete or return all personal data at the end of the service, and delete existing copies, unless law requires storage.
8. Make available all information needed to show compliance, and allow and contribute to audits and inspections. ## Key clauses in a Spanish DPA | Clause | Why it matters | | --- | --- | | Description of processing (Annex) | Required by Article 28(3); set purpose, data types, data subjects and duration. | | Instructions | Processor acts only on documented instructions. | | Confidentiality | Binds staff and contractors. | | Security measures | Reference Article 32; list technical and organisational measures. | | Sub-processors | Authorisation, list, notice of changes and flow-down of terms. | | Data-subject rights | How the processor helps the controller respond. | | Breach notification | Timing and content of processor notice to the controller. | | International transfers | Chapter V safeguards such as standard contractual clauses. | | Audit rights | Information, audits and inspections. | | Return or deletion | What happens to data at the end. | | Liability and indemnity | Allocation between the parties, within GDPR limits. | ## Spain-specific points to get right - The AEPD is the supervisor. It investigates complaints and has issued sanctions where a required DPA was missing or inadequate. A signed, accurate DPA is a basic compliance baseline, not a nicety.

• Sub-processors. Spanish controllers often insist on a maintained list and advance notice of changes, with a right to object. Make the mechanism explicit.
• International transfers. If the processor or its sub-processors sit outside the EEA, the DPA must cover a valid Chapter V transfer mechanism. Do not leave this to a generic clause.
• Language. A bilingual Spanish and English DPA is common. If a dispute reaches a Spanish court or the AEPD, a Spanish version helps.
• Keep the annex real. Regulators and courts look at whether the processing description actually matches what the processor does. A copied, generic annex is a weakness. ## A simple DPA template outline for Spain 1. Parties and roles (controller and processor)

2. Definitions aligned with the GDPR
3. Scope and documented instructions
4. Processor obligations (the eight Article 28 duties)
5. Confidentiality
6. Security measures (Article 32)
7. Sub-processors
8. Data-subject rights assistance
9. Personal data breach notification
10. International transfers (Chapter V)
11. Audits and information
12. Return or deletion on termination
13. Liability
14. Governing law (Spain) and jurisdiction
15. Annex 1: description of processing; Annex 2: security measures; Annex 3: approved sub-processors ## Common mistakes to avoid - Using a confidentiality clause in place of a real Article 28 DPA.

• Leaving the processing description blank or generic.
• Forgetting sub-processor authorisation and flow-down.
• Ignoring international transfer safeguards.
• Treating the DPA as a one-time document and never updating the sub-processor list or security annex. ## One workspace to manage DPAs and the contracts around them A DPA rarely travels alone. It sits beside a master services or SaaS agreement, and it has to stay current as sub-processors, security measures and transfer routes change. Tracking all of that by hand, across many vendors, is where things slip. An AI contract workspace keeps the DPA, its parent contract and its annexes together: draft from an approved Article 28 template, flag per-clause risk against how your company contracts, edit clauses in plain language, and track review dates and obligations on a live timeline. Adira is built for this, India-first today with other jurisdictions including Spain and the EU on the roadmap, so confirm Spanish and GDPR specifics with local counsel. The drafting, review and tracking you would otherwise do by hand can live in one workspace tuned to your business. This article is general information and not legal advice.