Data Processing Agreement for Websites: A Dutch SMB Guide

The decision rule in one sentence. If a third-party service touches the personal data of your visitors or customers, you need a written data processing agreement (in Dutch: verwerkersovereenkomst) with that vendor under Article 28 of the GDPR. That covers three common categories on almost every Dutch SMB website: analytics, hosting and email or marketing tools.

The Autoriteit Persoonsgegevens (AP) treats a missing or deficient verwerkersovereenkomst as an aggravating factor during AVG investigations. Booking.com was fined 475,000 euro by the AP in 2021, partly because of late breach reporting that involved a processor.

This guide explains who counts as a processor, which services usually require a DPA and what the agreement must contain. If you want to know whether your own site has missing DPAs and other gaps, run a free DPA gap check on your site.

Controller vs Processor in 30 Seconds

You are the data controller when you decide why personal data is collected and how it is used. The names, email addresses and purchase history of your customers belong to you as controller.

A third party is a data processor when it processes personal data only on your documented instructions. The processor acts as a service provider. It does not reuse the data for its own purposes.

Independent controllers are different. They receive your visitors' data and use it for their own purposes. You are not their controller. Examples are delivery companies that hold their own relationship with the customer, payment processors that run their own fraud detection and social media platforms that receive data via pixels for their own advertising.

The distinction matters because:

• Data processors: you need a verwerkersovereenkomst and you stay responsible
• Independent controllers: you need to disclose the data sharing in your privacy policy but they are responsible for their own processing

<svg viewBox="0 0 480 200" width="100%" style={{maxWidth: '480px', height: 'auto'}} role="img" aria-label="Diagram showing the data flow between controller, processor and sub-processor"> <rect x="20" y="60" width="120" height="80" rx="8" fill="#e0f2fe" stroke="#0284c7" strokeWidth="2"/> <text x="80" y="95" textAnchor="middle" fontFamily="sans-serif" fontSize="14" fontWeight="bold" fill="#0c4a6e">Controller</text> <text x="80" y="115" textAnchor="middle" fontFamily="sans-serif" fontSize="11" fill="#0c4a6e">You</text> <rect x="180" y="60" width="120" height="80" rx="8" fill="#dcfce7" stroke="#16a34a" strokeWidth="2"/> <text x="240" y="95" textAnchor="middle" fontFamily="sans-serif" fontSize="14" fontWeight="bold" fill="#14532d">Processor</text> <text x="240" y="115" textAnchor="middle" fontFamily="sans-serif" fontSize="11" fill="#14532d">Mailchimp</text> <rect x="340" y="60" width="120" height="80" rx="8" fill="#fef9c3" stroke="#ca8a04" strokeWidth="2"/> <text x="400" y="95" textAnchor="middle" fontFamily="sans-serif" fontSize="14" fontWeight="bold" fill="#713f12">Sub-processor</text> <text x="400" y="115" textAnchor="middle" fontFamily="sans-serif" fontSize="11" fill="#713f12">AWS</text> <path d="M140 100 L180 100" stroke="#0284c7" strokeWidth="2" markerEnd="url(#arrow)"/> <path d="M300 100 L340 100" stroke="#16a34a" strokeWidth="2" markerEnd="url(#arrow)"/> <text x="160" y="55" textAnchor="middle" fontFamily="sans-serif" fontSize="11" fill="#334155">DPA</text> <text x="320" y="55" textAnchor="middle" fontFamily="sans-serif" fontSize="11" fill="#334155">DPA</text> <defs> <marker id="arrow" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto"> <path d="M0,0 L0,6 L9,3 z" fill="#334155"/> </marker> </defs> </svg>

Common Website Services: Processor or Controller?

Where to Find DPAs for Common Services

Most major SaaS platforms publish a standard DPA. You typically accept it in account settings or by agreeing to updated terms of service.

Google Analytics or Google Workspace. Google publishes a Data Processing Amendment. You accept it in Google account settings, Data Processing Terms.

Mailchimp. The Mailchimp DPA is incorporated into its Terms of Service. You can review it in your account settings.

Stripe. Stripe offers a Data Processing Agreement on its legal page. Stripe is both a processor (for your billing) and an independent controller (for fraud and risk management).

Mollie. Mollie provides a standard DPA for Dutch merchants in the merchant portal.

Cloudflare. Cloudflare includes DPA terms in its service agreement. Enterprise plans add a separately signed DPA.

Hosting providers (TransIP, Antagonist, Siteground). Dutch and EU-based hosting providers usually include DPA terms in their service agreements or send a separate DPA on request.

If a service provider does not offer a DPA and still processes personal data on your behalf, that is a red flag. You cannot lawfully use that service for EU personal data.

What a DPA Must Contain (Article 28(3) GDPR)

Whether you sign a vendor's standard DPA or negotiate your own, the contract must set out the items below. These map directly to the canonical Article 28 text on EUR-Lex.

Sub-processors

A sub-processor is a third party that your processor uses to process your data. Example: Mailchimp uses AWS to host its servers. AWS is the sub-processor for your data.

The DPA must specify:

• Whether you give general or specific authorisation for sub-processors
• What notification the processor must send when it changes a sub-processor
• That the processor must impose the same data protection obligations on every sub-processor

Most SaaS DPAs include a list of approved sub-processors and a commitment to notify you before adding a new one.

Booking and Reservation Systems (Hospitality Notes)

If you run a restaurant, hotel or other hospitality business that uses an online booking system, that platform is almost certainly your data processor. Guests submit their names, phone numbers and sometimes dietary requirements. The booking system processes all of it on your behalf.

Examples and DPA status:

• Formitable or Zenchef. Merged in 2023, serving 25,000 or more restaurants. DPA available in account settings.
• OpenTable. Acts as processor for restaurant bookings. DPA incorporated in its terms.
• Resengo. Dutch booking platform. DPA available on request.

Check whether your booking system's DPA covers the specific data you collect. Dietary requirements and allergy notes count as health data under Article 9 GDPR and need stricter handling.

When You Are the Sub-processor

If you build websites, run social media or sell digital services on behalf of clients, you may yourself be a data processor. You process your clients' customers' data. Your clients need a verwerkersovereenkomst with you. If they do not provide one, offer one yourself. That protects both parties.

AP Enforcement Signals

The Autoriteit Persoonsgegevens does not publish a public register of fines for missing DPAs alone. It treats DPA gaps as part of a wider investigation. Two signals matter for Dutch SMBs:

• The AP published guidance on verwerkersovereenkomsten for organisations to follow.
• The 475,000 euro Booking.com fine involved a late breach report linked to a processor. A clear DPA would have set the notification timing in advance.

The lesson for small businesses: a missing DPA rarely triggers a standalone fine, but it raises the cost of any breach or complaint that does land at the AP.

Practical Steps

1. List all third-party services that touch your website data
2. Classify each as processor, independent controller or joint controller
3. Locate the DPA for each processor (account settings or legal pages)
4. Accept or sign the DPA and keep a record (screenshot, email confirmation, signed document)
5. Add the processor to your internal verwerkingsregister and privacy policy
6. Review annually and after every change of vendor

For the full picture of GDPR obligations for your website, use our GDPR compliance checklist. To check the current state of your own site, start a free scan.

---

This article is technical analysis, not legal advice. Consult a lawyer for advice specific to your situation.