ERP Vendor GDPR Data Processing Agreement (DPA) Outline Template
Any vendor that hosts or supports your ERP and can see personal data is a processor under the GDPR, and Article 28 requires a written contract with specific terms. This outline lays out those terms in a balanced form so you can check a vendor's draft against it.
Fill in
ERP Vendor Data Processing Agreement Outline
Data Processing Agreement Outline
Between Nordwerk Maschinenbau GmbH (controller) and Example ERP Hosting B.V. (processor) Date: 2026-11-01 Term: For the duration of the main services agreement
1. Subject matter and nature of processing
The processor provides the following service to the controller: Hosting and application support of the ERP system. Processing takes place in: Data centres in Germany and the Netherlands.
2. Types of data and data subjects
Categories of personal data: Employee master data, customer contact data, supplier contact data, user login data Categories of data subjects: Employees, customer contacts, supplier contacts
3. Instructions
The processor processes personal data only on documented instructions from the controller, including for transfers to a third country, unless required otherwise by law, in which case it informs the controller beforehand.
4. Confidentiality and security
Persons authorised to process the data are bound by confidentiality. The processor implements technical and organisational measures appropriate to the risk, described in an annex (access control, encryption, backup, logging, separation of customers, recovery).
5. Sub-processors
The processor engages sub-processors only with prior general or specific written authorisation and imposes equivalent obligations on them. The processor lists current sub-processors in an annex and informs the controller of changes with a period to object.
6. Assistance and breach notification
The processor assists with data subject requests, impact assessments and consultations. The processor notifies the controller of a personal data breach without undue delay and in any case within 48 hours of becoming aware.
7. Audit
The processor makes available information necessary to demonstrate compliance and allows for audits, including inspections, by the controller or an auditor mandated by it, with reasonable notice.
8. Return and deletion
At the end of the services, the processor deletes or returns all personal data at the controller's choice and confirms deletion in writing, unless law requires storage.
Annexes
| Annex | Content | Status |
|---|---|---|
| A | Description of processing | |
| B | Technical and organisational measures | |
| C | Approved sub-processors | |
| D | Transfer mechanism if outside the EEA |
Signatures
This is a starting point, not legal advice. It follows the structure of GDPR Article 28(3). Have your data protection officer or counsel review it, and check whether the vendor's own template or the EU standard contractual clauses for controller to processor should be used.
Keep ERP data in your own environment
Learn how private AI over ERP data can run on your own servers without sending data to a third party.
Optional. The tool and every export work without this. No spam.
How to use the outline
Fill in the parties, service description, categories of data and subjects, location and breach notification period. Export the document and compare it to the vendor's DPA, clause by clause. Where the vendor's paper is missing an element, ask for it. If the vendor proposes its own standard DPA, use this outline as a checklist, not as a competing contract.
- List data categories specifically, not just personal data
- Fix the breach notification time in hours
- Obtain the sub-processor list and change procedure
- Attach the security measures as an annex
What Article 28 requires
The contract must set out the subject matter, duration, nature and purpose of processing, the type of data and categories of data subjects. It must require processing only on documented instructions, confidentiality, appropriate security, sub-processor conditions, assistance with data subject rights and with security and breach obligations, deletion or return of data at the end and audit rights. The outline covers each of these in order.
ERP specific points
ERP systems contain personal data in places teams forget: HR and payroll interfaces, user logs, attachments, e-mail archives, support tickets with screenshots and test environments copied from production. Ask how the vendor handles support access to production, whether test copies are anonymised and where backups are stored. Remote support from outside the EEA can be a transfer needing a safeguard.
Common mistakes
Signing a vendor DPA without reading the annexes is the most common failure, because security measures and sub-processors live there. Another is forgetting to update the list of sub-processors or the data categories when the ERP scope grows to include new modules. Review the DPA at each major change and at renewal.
Frequently Asked Questions
Is an ERP vendor always a processor?
Usually, when it hosts the system or has access to personal data to provide support on your instructions. A vendor that only sells software licences and has no access to your data is generally not a processor for that activity.
Can I use the vendor's standard DPA?
Often yes, if it covers the Article 28 elements and you check the annexes. Negotiate where it is weak, for example breach notification periods, audit rights or deletion deadlines. Have your data protection officer review it.
What about processing outside the EEA?
A transfer needs a legal mechanism such as an adequacy decision or standard contractual clauses plus a transfer assessment. Remote access for support from a third country counts as a transfer, so document it in the annexes.
How long should a breach notification period be?
The controller has to notify the authority within 72 hours of becoming aware, so the processor must notify the controller quickly. Many contracts use 24 to 48 hours. Avoid periods that leave the controller too little time.
For air-gapped or on-premise AI over ERP data, the architecture can keep personal data inside your own environment, which simplifies this analysis. We are glad to explain how. Optional.
Related Tools
ERP Five Year TCO Calculator
Estimate multi-year ERP cost including licences, services, maintenance, hosting and internal staff, and compare cost per user per year.
ERP OperationsERP Interface Register Worksheet
Inventory every system that talks to your ERP with protocol, frequency, volume, owner and criticality, before a migration or upgrade.
ERP Migration & SelectionERP Fit-Gap Analysis Worksheet
Score each requirement against a candidate ERP, classify the gap resolution and get a weighted fit percentage you can defend in a steering meeting.
ERP OperationsERP Project Steering Committee Report Template
A one-to-two page monthly steering report for ERP implementations with RAG status, milestones, budget burn, risks and decisions required.
More Compliance & Contracts tools
See all- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- GDPR ERP Data Migration Checklist
- EU Machinery Regulation 2023/1230 Readiness Checklist
- ERP Contract Clauses Glossary Reference