Data Processing Agreement in Ireland: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) is the contract between a party that decides why and how personal data is used (the controller) and a party that processes that data on its behalf (the processor). It sets what the processor may do, the security it must keep, how it handles breaches and sub-processors, and what happens to the data at the end. In Ireland, a DPA is not optional where you use a processor: it is required by the General Data Protection Regulation (GDPR), and most of its mandatory content is spelled out in Article 28. ## When you need a DPA in Ireland Use a DPA whenever a third party processes personal data on your instructions: hosting and SaaS, customer support, analytics, HR and payroll, outsourced IT, marketing. If two parties each decide independently why they use the data, that is a controller-to-controller or joint-controller arrangement, not a controller-to-processor DPA. ## What Irish and EU law require Ireland applies the GDPR (Regulation (EU) 2016/679) together with the Data Protection Act 2018. The supervisory authority is the Data Protection Commission (DPC). Article 28 GDPR requires a written contract between controller and processor, and sets out what it must contain: - Subject matter and detail. The subject matter and duration of processing, its nature and purpose, the types of personal data and categories of data subjects.

• Processing on documented instructions. The processor acts only on the controller's documented instructions, including on international transfers.
• Confidentiality and security. Staff bound to confidentiality, and appropriate technical and organisational security measures.
• Sub-processors. No sub-processor without authorisation, with the same obligations flowed down.
• Assistance. Help the controller with data subject rights, security, breach notification and data protection impact assessments.
• Return or deletion. Return or delete personal data at the end of the service, as the controller chooses.
• Audits. Make available the information needed to show compliance and allow audits. For international transfers outside the EEA, the DPA should set the lawful transfer mechanism, usually the European Commission's Standard Contractual Clauses (adopted in June 2021) or an adequacy decision. ## Key clauses in an Irish DPA ### Roles and scope Name the controller and processor and set out the Article 28(3) detail: subject matter, duration, nature, purpose, data types and categories of data subjects. ### Processing on documented instructions The processor acts only on instructions and flags any instruction it believes breaches data protection law. ### Security measures Technical and organisational measures appropriate to the risk, aligned with Article 32 GDPR. ### Sub-processors Authorisation, notice of changes, and flow-down of equivalent terms. ### Breach notification The processor notifies the controller without undue delay so the controller can meet its own 72-hour notification duty to the DPC where required. ### International transfers The lawful basis for any transfer outside the EEA, such as SCCs, and any transfer impact assessment. ### Data subject rights and audits Assistance with requests, and audit and information rights for the controller. ### Return or deletion Return or delete personal data and copies on termination, as the controller chooses. ## A simple Irish DPA template outline 1. Parties (controller and processor) and effective date

2. Definitions (aligned to the GDPR)
3. Subject matter, duration, nature and purpose (Article 28(3) detail)
4. Types of personal data and categories of data subjects
5. Processing on documented instructions
6. Confidentiality of personnel
7. Security measures (Article 32)
8. Sub-processors and flow-down
9. Assistance with data subject rights
10. Breach notification
11. International transfers and SCCs
12. Audits and information rights
13. Return or deletion on termination
14. Liability and governing law (Ireland)
15. Signature blocks ## How to draft and review one well Match the DPA to the real data flow: what the processor touches, where it sits and which sub-processors see it. Keep the breach-notice window tight enough to meet your 72-hour DPC duty. Check transfer mechanisms whenever data leaves the EEA, and review the DPA when the service or sub-processors change, not only at signing. ## Draft, review and track a DPA in one workspace A DPA usually lives next to a services or SaaS contract, and the two drift apart as vendors and sub-processors change. Adira is an AI legal operating system that keeps drafting, clause-level review and version history in one place, so the DPA stays linked to the main contract and its review dates. Adira is India-first today; deeper Ireland and EU GDPR coverage is on its roadmap, so treat Ireland-specific drafting as a starting point to confirm with local counsel. See the approach at Adira. This article is general information, not legal advice. Confirm current GDPR requirements and DPC guidance with a qualified solicitor before you sign.