When an agency, a freelancer or a platform processes personal data on behalf of a company, GDPR requires a contract that defines what it may and may not do. Many ad accounts run without this written framework. Knowing the essentials avoids surprises.
The essentials in a definition
Data processing contracts set out responsibilities between the advertiser, platforms and agencies when personal data are processed. The GDPR requires written agreements with processors and, in some cases, joint responsibility. The EDPB and CNPD publish guidance on these roles, which should be confirmed with legal support.
Who is who
The company that decides the purposes and means of processing is, as a rule, the controller. Whoever processes data on its behalf (agency, tool vendor) is the processor. Some platforms take on roles of their own, depending on the terms of each service.
This distinction determines responsibilities, obligations and what must appear in the contract.
What the contract should provide for
Subject matter and duration of processing, types of data and data subjects, purposes, the obligation to process only on instructions, confidentiality, security measures, rules for further sub-processors, help with data-subject requests, incident notification and what happens to the data at the end.
Have the wording checked by legal advisers. This text is informative and does not replace advice.
Putting data processing on paper
- Identify controller and processors
- Check the contract with each supplier
- Keep platforms’ accepted terms
- Review access and contracts every year
Platforms and standard terms
The big platforms offer data processing terms that you accept when using the services. Read them and understand what they cover: which data, for what purposes, with what safeguards. Check whether there are transfers outside the EU and which mechanisms legitimise them.
Keep copies of the versions accepted and of any changes.
What is not written down is hard to prove.
Day-to-day practice
Keep a list of suppliers with access to data, the corresponding contract and the review date. Control who has access to accounts and remove access when someone leaves.
When you change agency, ensure the return or deletion of data and the transfer of accounts, as the contract provides.
Decision table
| Relationship | Typical role | What to require in writing |
|---|---|---|
| Advertiser and agency | Controller and processor | Purposes, security measures, sub-processors |
| Advertiser and platform | Depends on the service; may be joint controllership | The platform’s data-processing terms |
| Advertiser and tool vendor | Processor | Data location, retention, audit |
| Partnerships between brands | Joint or independent controllers | Who answers for what and how rights are exercised |
Common mistakes to avoid
- Accepting terms without reading. Check roles, data location and sub-processors.
- Not having a contract with the agency. The law requires a written agreement when processing on behalf of others.
- Not updating. Contracts should reflect current services.
How to measure the result
Keep a supplier register with contract date, purposes and annual review; track data-subject requests and response time.
Limits and exceptions
Contracts do not replace good practice: a well-written agreement does not protect if, in practice, data are used for other purposes or security measures fail. Qualifying roles (controller, processor, joint) can be complex and depend on the facts. Do not use this content as legal advice; consult a professional for your case and review agreements when services change.
Illustrative example
Illustrative example: a company lists all suppliers that touch customer data (platforms, agency, email tool, reporting dashboard) and checks whether there is a processing agreement with each. It finds the dashboard tool has none. It resolves this before continuing, and keeps a table of suppliers, purposes and data location.
Frequently asked questions
Do I need a contract with the agency?
If the agency processes personal data on your behalf, GDPR requires a written framework.
And with the platforms?
The platform’s data processing terms apply. Read them and keep a copy.
Who validates the text?
A lawyer or the data protection officer.
Is the agency always a processor?
In many cases yes, but it depends on how data are decided and used; confirm with legal support.
Do platforms have processing terms?
Normally yes, and it pays to read and accept them consciously.
GDPR requires written agreements defining roles, purposes, security and sub-processors between advertiser, platforms and agencies; a supplier register eases verification.
Sources and recommended reading
- General Data Protection Regulation (GDPR)
- European Data Protection Board (EDPB)
- Portuguese Data Protection Authority (CNPD)
Last editorial review: October 2026. Informational content; always confirm current conditions in the official sources before deciding.