A Data Processing Agreement (DPA) is a mandatory contract under Article 28 of the GDPR between a controller (event organizer) and a service provider that processes personal data on their behalf. It governs the subject matter, duration, nature, and purpose of the processing, as well as security and control obligations.
Legal basis: Article 28 GDPR
Form: Written, including electronic format
Sanctions: Up to €10 million / 2% of annual turnover
What is a Data Processing Agreement?
The Data Processing Agreement (DPA) – also known as an Auftragsverarbeitungsvertrag (AVV) – is a mandatory document under the GDPR. Whenever an event organizer provides personal data to an external service provider who processes it on their behalf, Article 28 of the GDPR requires a written contract – before the first data flow occurs.
In event practice, this is often overlooked: organizers need a DPA with the printing service for name badges, the hotel for room allotments, the catering service, the email marketing provider, and the lead retrieval provider – with all these partners. Failing to do so leads to risks of fines and reputational damage.
When is a DPA necessary?
A DPA is required if:
- Personal data is involved (names, emails, IDs, payment data, etc.)
- A service provider processes data on behalf of the controller (not as a joint controller or independent recipient)
- The processing is not merely an incidental part of another primary service (e.g., a tax advisor is a recipient, not a data processor)
Typical data processors at events:
- Congress management software and SaaS providers
- Email marketing service providers (e.g., newsletter tools)
- Printing services for badges and programs
- Hotels and hotel allotment agencies, provided they act on behalf of the organizer
- Lead retrieval providers
- Web analytics and tracking services
- Telephone service providers for hotlines
- Cloud hosting and backup providers
Mandatory content
According to Article 28(3) of the GDPR, a DPA must at least contain:
- Subject matter of processing: What data is processed and why?
- Duration of processing: How long is the contract term?
- Nature and purpose: Specific operations (storing, sending, analyzing)
- Categories of data subjects (attendees, speakers, sponsors)
- Obligations and rights of the controller
- Technical and organizational measures (TOMs): encryption, access controls, backup, pseudonymization
- Instruction-based processing: service provider may only act on instructions
- Confidentiality obligation of employees
- Handling of sub-processors – list or individual approval
- Data transfers to third countries: standard contractual clauses, adequacy decisions
- Assistance and support obligations regarding data subject rights
- Notification obligations in case of data breaches (within hours, not days)
- Audit rights: organizer may have the service provider audited
- Return or deletion of data after contract termination
Sub-processors
A typical SaaS provider works with other service providers themselves (cloud hosting, email delivery, monitoring). These are sub-processors. The DPA must regulate:
- List of existing sub-processors with names, locations, and processing purposes
- Approval of additional sub-processors (general vs. individual)
- Notification period for changes
- Right to object for the controller
- Contractually equivalent obligations for sub-processors
Common practical mistakes
- No DPA with the printing service for name badges – a common gap
- "Light" DPAs without clearly defined TOMs
- DPA signed after contract start instead of before
- List of sub-processors is not maintained
- Third-country data transfers not sufficiently regulated (be careful with US cloud providers!)
- Outdated versions kept on file, failing to reflect new contractual situations
Best practices
- Maintain your DPA list: Which service provider, which DPA, which version, which date?
- Sign the DPA before the first data flow occurs, not retroactively
- Use standard templates from the industry or your own data protection officer
- Review the sub-processor list provided by the platform vendor
- Prefer EU hosting whenever possible – it reduces third-country complexity
- Treat the DPA as a selection criterion for new service providers
DPA in Converia
Converia provides an up-to-date, legally vetted data processing agreement that has been coordinated with the data protection officers of German universities – included in our general terms and conditions and customizable as needed. Includes a sub-processor list and an overview of technical and organizational measures.
DPA out-of-the-box, not as a special case
At Converia, the data processing agreement is standard, not an add-on – clearly documented and accessible at any time.
- GDPR for events – Compliance & Law
- Payment management – Ticketing & Registration
- Attendee management – Ticketing & Registration
Legally vetted DPA during the onboarding process – including a sub-processor list.