# ERP Vendor GDPR Data Processing Agreement (DPA) Outline Template > Source: https://netray.co/tools/eu-erp-processor-agreement-outline-template > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A balanced outline of the clauses a controller typically checks in a GDPR Article 28 processing agreement with an ERP, hosting or support vendor. ## Category compliance-legal ## Region Europe ## Industry Discrete Manufacturing ## Audience - Data protection officer - IT manager - Procurement ## Tool **Kind:** template **Output:** document **Fields:** #### Controller (customer) **Key:** controller **Type:** text **Default:** Nordwerk Maschinenbau GmbH #### Processor (vendor) **Key:** processor **Type:** text **Default:** Example ERP Hosting B.V. #### Service provided **Key:** service **Type:** text **Default:** Hosting and application support of the ERP system #### Categories of personal data **Key:** data_types **Type:** textarea **Default:** Employee master data, customer contact data, supplier contact data, user login data #### Categories of data subjects **Key:** subjects **Type:** text **Default:** Employees, customer contacts, supplier contacts #### Processing location **Key:** location **Type:** text **Default:** Data centres in Germany and the Netherlands #### Breach notification (hours) **Key:** notice_hours **Type:** number **Default:** 48 #### Term **Key:** term **Type:** text **Default:** For the duration of the main services agreement #### Date **Key:** date **Type:** date **Default:** 2026-11-01 **Blocks:** #### Data Processing Agreement Outline **Body:** Between {{controller}} (controller) and {{processor}} (processor) Date: {{date}} Term: {{term}} #### 1. Subject matter and nature of processing **Body:** The processor provides the following service to the controller: {{service}}. Processing takes place in: {{location}}. #### 2. Types of data and data subjects **Body:** Categories of personal data: {{data_types}} Categories of data subjects: {{subjects}} #### 3. Instructions **Body:** The processor processes personal data only on documented instructions from the controller, including for transfers to a third country, unless required otherwise by law, in which case it informs the controller beforehand. #### 4. Confidentiality and security **Body:** Persons authorised to process the data are bound by confidentiality. The processor implements technical and organisational measures appropriate to the risk, described in an annex (access control, encryption, backup, logging, separation of customers, recovery). #### 5. Sub-processors **Body:** The processor engages sub-processors only with prior general or specific written authorisation and imposes equivalent obligations on them. The processor lists current sub-processors in an annex and informs the controller of changes with a period to object. #### 6. Assistance and breach notification **Body:** The processor assists with data subject requests, impact assessments and consultations. The processor notifies the controller of a personal data breach without undue delay and in any case within {{notice_hours}} hours of becoming aware. #### 7. Audit **Body:** The processor makes available information necessary to demonstrate compliance and allows for audits, including inspections, by the controller or an auditor mandated by it, with reasonable notice. #### 8. Return and deletion **Body:** At the end of the services, the processor deletes or returns all personal data at the controller's choice and confirms deletion in writing, unless law requires storage. #### Annexes **Table:** **Columns:** - Annex - Content - Status **Rows:** **0:** A **1:** Description of processing **0:** B **1:** Technical and organisational measures **0:** C **1:** Approved sub-processors **0:** D **1:** Transfer mechanism if outside the EEA #### Signatures **Signatures:** - Controller - Processor **Notes:** This is a starting point, not legal advice. It follows the structure of GDPR Article 28(3). Have your data protection officer or counsel review it, and check whether the vendor's own template or the EU standard contractual clauses for controller to processor should be used. ## Content **Intro:** Any vendor that hosts or supports your ERP and can see personal data is a processor under the GDPR, and Article 28 requires a written contract with specific terms. This outline lays out those terms in a balanced form so you can check a vendor's draft against it. **Sections:** #### How to use the outline **Body:** Fill in the parties, service description, categories of data and subjects, location and breach notification period. Export the document and compare it to the vendor's DPA, clause by clause. Where the vendor's paper is missing an element, ask for it. If the vendor proposes its own standard DPA, use this outline as a checklist, not as a competing contract. **Bullets:** - List data categories specifically, not just personal data - Fix the breach notification time in hours - Obtain the sub-processor list and change procedure - Attach the security measures as an annex #### What Article 28 requires **Body:** The contract must set out the subject matter, duration, nature and purpose of processing, the type of data and categories of data subjects. It must require processing only on documented instructions, confidentiality, appropriate security, sub-processor conditions, assistance with data subject rights and with security and breach obligations, deletion or return of data at the end and audit rights. The outline covers each of these in order. #### ERP specific points **Body:** ERP systems contain personal data in places teams forget: HR and payroll interfaces, user logs, attachments, e-mail archives, support tickets with screenshots and test environments copied from production. Ask how the vendor handles support access to production, whether test copies are anonymised and where backups are stored. Remote support from outside the EEA can be a transfer needing a safeguard. #### Common mistakes **Body:** Signing a vendor DPA without reading the annexes is the most common failure, because security measures and sub-processors live there. Another is forgetting to update the list of sub-processors or the data categories when the ERP scope grows to include new modules. Review the DPA at each major change and at renewal. **Cta:** For air-gapped or on-premise AI over ERP data, the architecture can keep personal data inside your own environment, which simplifies this analysis. We are glad to explain how. Optional. **Faq:** #### Is an ERP vendor always a processor? **Answer:** Usually, when it hosts the system or has access to personal data to provide support on your instructions. A vendor that only sells software licences and has no access to your data is generally not a processor for that activity. #### Can I use the vendor's standard DPA? **Answer:** Often yes, if it covers the Article 28 elements and you check the annexes. Negotiate where it is weak, for example breach notification periods, audit rights or deletion deadlines. Have your data protection officer review it. #### What about processing outside the EEA? **Answer:** A transfer needs a legal mechanism such as an adequacy decision or standard contractual clauses plus a transfer assessment. Remote access for support from a third country counts as a transfer, so document it in the annexes. #### How long should a breach notification period be? **Answer:** The controller has to notify the authority within 72 hours of becoming aware, so the processor must notify the controller quickly. Many contracts use 24 to 48 hours. Avoid periods that leave the controller too little time. ## Search terms gdpr data processing agreement template, dpa template erp vendor, article 28 processor agreement, erp cloud data processing agreement, auftragsverarbeitungsvertrag muster, processor agreement checklist --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json