Data Processing Agreement (AVV): When You Need One

A company that uses a hosting provider, a newsletter tool or cloud software passes personal customer data to an external service provider. Without a valid data processing agreement (Auftragsverarbeitungsvertrag, AVV), this data processing is not lawful.

In brief: a data processing agreement (AVV) is a written agreement between you as the controller and every service provider that processes personal data on your behalf, such as hosting, newsletter or cloud providers. All companies that use such services are affected. If the AVV is missing, the data processing is unlawful, and fines under Art. 28 GDPR are possible.

Who has to conclude an AVV?

Every company that passes personal customer data to an external service provider for processing must conclude an AVV with that provider. This typically affects hosting providers, newsletter tools, CRM systems and cloud providers, that is, practically every company that uses standard digital services on which customer data is stored. Small businesses and the self-employed are affected too, as soon as they have email addresses, order data or other personal information processed through an external service. You are responsible for concluding it as the controller within the meaning of the GDPR, not the service provider; the initiative and the review therefore lie with you.

What exactly must an AVV regulate?

Art. 28 GDPR prescribes that the AVV sets out the processor's obligations as well as your control rights as the controller. These include, among other things, the subject matter and duration of the processing, its nature and purpose, the categories of data concerned, as well as instruction rights and deletion obligations. The agreement ensures that the service provider processes the data only on your instructions, takes appropriate security measures and gives you the means to monitor and verify. If the service provider processes data outside the EU, the AVV alone is not enough; a transfer mechanism such as EU standard contractual clauses is also required so that the level of data protection is maintained outside the EU as well.

How do you proceed when concluding an AVV?

The conclusion can be structured in a few steps. It starts with a complete overview of all service providers in use and ends with the ongoing maintenance of that overview:

1. Identify all service providers that process customer data on your behalf (hosting, email marketing, CRM, cloud …).
2. Check whether the provider offers an AVV under Art. 28 GDPR (for standard software, usually available in the customer portal).
3. Sign the AVV and file it centrally.
4. For providers outside the EU, also check the transfer mechanism (e.g. standard contractual clauses).
5. Keep the list of AVVs up to date when providers are added or changed.

Especially when many tools and providers have been added over the years, it is easy to lose track of which agreements are still missing. Which service providers and obligations are specifically relevant in your company is shown at a glance by a tool such as Company Audit.

What are the consequences if the AVV is missing?

If the AVV is missing, the data processing by the service provider is not lawful, regardless of how carefully the provider itself handles the data. The absence of the agreement alone already constitutes a violation of Art. 28 GDPR, even if a data protection incident never occurs. Under Art. 28 GDPR, fines of up to 20 million euros or 4% of worldwide annual turnover are possible, whichever amount is higher.

What should you pay attention to in practice?

Large providers such as Google, Microsoft or Stripe usually provide their AVV as a standard document to accept online, which can be concluded without negotiation. With smaller or specialised providers, it is worth actively checking the customer portal or asking directly if no AVV can be found. An AVV is also mandatory for free tools; without it, the processing on behalf of a controller is not lawful, even if no money changes hands. A central, up-to-date list of all concluded AVVs makes it easier to provide proof quickly during audits or customer enquiries.

Frequently asked questions

Do I need an AVV for free tools as well?

Yes. Whether a service is paid or not does not matter. As soon as an external service provider processes personal data on your behalf, an AVV under Art. 28 GDPR is required.

Is it enough if the service provider stores the data securely?

No. Technical security alone does not make the processing lawful. Without the written AVV, the contractual basis that Art. 28 GDPR prescribes for processing on behalf of a controller is missing.

Where do I find a provider's AVV?

For standard software, the AVV is usually stored in the provider's customer portal and can be accepted there directly online, for example with large providers such as Google, Microsoft or Stripe.

What else needs to be considered if the service provider is based outside the EU?

For a data transfer to third countries outside the EU, a transfer mechanism is necessary in addition to the AVV, for example EU standard contractual clauses.

Who bears responsibility if the AVV is missing?

As the controller within the meaning of the GDPR, you must ensure that the AVV is concluded. If it is missing, you face fines of up to 20 million euros or 4% of annual turnover under Art. 28 GDPR.

Source: Art. 28 GDPR. This article is general information and does not replace legal advice in individual cases. As of: July 2026.