Do we need a contract with vendors that process data for us?
By Advisorn · updated on 17 October 2026 · Art. 9 FADP, Art. 28 GDPR
In short
Yes. A business may assign a processing to a vendor (processor) by contract, if the vendor processes the data only in the way the business itself could and guarantees its security (Art. 9 FADP). The vendor may assign it in turn to third parties only with the business's authorisation; under the GDPR the contract must be in writing and have the content of Art. 28 GDPR.
Who is a processor
Anyone who processes data on your behalf and on your instructions: the provider of the business software, the cloud service, the fiduciary that runs the payroll, the agency that sends the newsletters. Someone who decides for themselves how to use the data is not, such as a bank or an insurer for its own purposes.
What to put in the contract
- subject matter, duration, nature and purpose of the processing;
- the duty to follow your instructions and to keep the data confidential;
- the security measures;
- the rules on sub-processors;
- help in answering requests and in handling breaches;
- the return or deletion of the data at the end.
Related questions
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.