A data processing agreement, known in Swedish as a biträdesavtal, is required by law every time you engage an outside party to process personal data on your behalf. Your payroll bureau, your CRM, your cloud accounting, and a long list of others. Below are the five most common pitfalls and what a template has to cover to hold up. These agreements are also one of the core steps in our GDPR guide for smaller companies.
The problem is rarely that companies have no agreements at all. It is that the agreements they have are thin, out of date or never read.
Here are the five mistakes we see most.
1. There is no agreement
The most common mistake is also the simplest: nothing was ever signed. Usually because the supplier did not offer one and the buyer never asked.
Go through your existing suppliers, starting with the obvious ones: payroll, HR systems, CRM, ticketing, email marketing, support chat. Where there is no agreement, put one in place.
Any serious SaaS supplier has a standard agreement ready. Ask for it.
2. The agreement does not describe what the supplier actually does
Many agreements are generic. They do not say which categories of personal data are processed, for what purposes, or what the supplier does with them. That makes the agreement hard to rely on when something goes wrong.
A good agreement specifies the type of data (names, email addresses, employment details), whose data it is (your customers, your employees), and what the supplier actually does with it. Does it store, analyse or pass the data on?
3. Sub-processors are not mentioned
Almost every SaaS supplier uses sub-processors of its own: cloud platforms, support tools, analytics. As controller, you are answerable for the whole chain.
Check that your agreement governs how the supplier handles its sub-processors, and that you have the right to be told when one is added or replaced.
4. Transfers outside the EU are not addressed
If your supplier stores or processes data outside the EU and the EEA, which is common with American SaaS providers, there has to be a legal basis for it. Usually that is the EU standard contractual clauses, or an adequacy decision covering the country in question.
Check whether your supplier uses American servers or services, and how the legal basis for the transfer is handled. It should be set out in the agreement or in documentation alongside it.
5. Nobody has looked at it in years
Requirements, technical solutions and supplier business models all move. An agreement that was correct in 2019 may have gaps in 2026.
Set a routine to review the agreements with your most important suppliers at least once a year. It does not need to be a legal deep dive, but you should check that the description still matches reality, that the sub-processor list is current and that transfers outside the EU are properly handled.
In short
A data processing agreement is not a formality. It is part of your risk management. A supplier who suffers a breach while processing your customers’ personal data without a proper agreement in place is your problem as much as theirs. Agreements in order reduce your exposure and put you in a stronger position if something does happen. Those suppliers should also appear as recipients in your record of processing activities.
Unsure where you stand otherwise? Our Compliance Health Check gives you a quick picture, area by area.
