Skip to content
newsletter-marketing24.deLaw · Deliverability · Metrics

Last reviewed:

Translated from German; if the versions differ, the German version applies.

Not legal advice: Legal content on this page appears only as verbatim quotations from statutes, court rulings or authority papers, with their source; quotations from German texts are our working translations. We do not assess them ourselves, and no lawyer has reviewed this page. It is no substitute for legal advice in your individual case.

Processing on behalf

In short: “Processing on behalf” (in German „Auftragsverarbeitung“) is the common name for what a processor does. The EU General Data Protection Regulation (GDPR) defines “processor” as “a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller” (Art. 4(8) GDPR).

The two roles

The GDPR distinguishes between the one who decides and the one who carries out. Under Art. 4(7) GDPR, “controller” means “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”. The processor processes “on behalf of the controller” (Art. 4(8)).

In everyday newsletter work, the term comes up above all when choosing a sending service: as the question of whether the service offers a data processing agreement. Common German abbreviations are AVV or AV-Vertrag; in English, “data processing agreement” (DPA) is also used.

What Art. 28 GDPR says, verbatim

GDPR quotations follow the official English text. Quotations from German authority papers are our working translations; only the German wording is authoritative (see the German version of this page).

“Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.” — Art. 28(1) GDPR

“Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.” — Art. 28(3) sentence 1 GDPR

On form: “The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form.” (Art. 28(9) GDPR)

What the data protection authority writes

The data protection commissioner of Baden-Württemberg writes in his guidance for clubs: “Under the GDPR, commissioned processing is characterised by the processor being bound by the controller’s instructions beyond the mere commissioning, even if the processor has more extensive know-how than its client and a certain scope for independent decisions, and by the processor being monitored by the controller, even if the controller engages another body for this purpose.” And in the same section: “Commissioned data processing also exists where a club does not store its members’ data on its own IT equipment but instead uses, via the internet, a database server that a service company provides for this purpose. Using the services of the post office (letter mail) or of the operator of a mail server (when sending emails) does not give rise to commissioned data processing.” (LfDI Baden-Württemberg, „Datenschutz im Verein nach der Datenschutzgrundverordnung (DS-GVO)“, as of 24 June 2020, section 3.2, our translation)

Whether a particular newsletter service that stores lists, manages sign-ups and evaluates opens or clicks is a processor is not expressly answered by the texts quoted here. We give no assessment of our own.

How it differs

  • Processor and controller: The GDPR defines the two roles separately (Art. 4(7) and (8), wording above). Which role a particular service has in an individual case is not something we assess.
  • Processing on behalf and legitimate interest: Legitimate interest is a legal basis for processing; processing on behalf describes who carries it out.

Easily confused

  • „Auftragsdatenverarbeitung“: The older German expression is still in use. The Baden-Württemberg guidance quoted uses it in the same section alongside „Auftragsverarbeitung“ and refers there to “the previously applicable provisions of Section 11 BDSG” (Bundesdatenschutzgesetz, the German Federal Data Protection Act; our translation).

Example from the wording

Art. 28(3) sentence 1 lists what the contract sets out. For reference, as a list:

  • the subject-matter and duration of the processing
  • the nature and purpose of the processing
  • the type of personal data
  • the categories of data subjects
  • the obligations and rights of the controller

The paragraph then continues with a list of points that the contract stipulates “in particular” (points (a) to (h)).

Frequently asked questions

What is processing on behalf? The processing of personal data by a body “on behalf of the controller”, as Art. 4(8) GDPR puts it.

What does AVV mean? The usual German abbreviation for the contract on processing under Art. 28(3) GDPR; you also see AV-Vertrag or, in English, DPA (data processing agreement).

Do I have to conclude a data processing agreement with my newsletter service? We do not answer this question. The quoted wordings are above; the selection checklist lists the data processing agreement as a question for the provider.

Matching tool