Saya & Associates
DPA vs NDA: why an NDA is not a data processing agreement
The customer asked for a DPA and got the NDA
A customer asks your SaaS business to sign a data processing agreement. Your team replies with the mutual NDA signed during the sales process: both documents mention confidential information, so the request seems covered.
It usually is not. The NDA says who may see the information.
It does not say what you may do with the customer's personal data, on whose instructions, through which sub-processors, or what happens to it when the contract ends. This example is fictional.
What each document is for
| NDA | DPA | |
|---|---|---|
| Protects | Confidential information, as the NDA defines it | Personal data processed for the customer |
| Main question | Who may disclose or use the information | What the processor may do with the data, and on whose instructions |
| Typical terms | Definition, permitted use, disclosure limits, return or destruction | Processing description, instructions, sub-processors, security, assistance, deletion or return, audits |
| Legal source | Contract law | GDPR Article 28 where it applies; section 8(2) of the DPDP Act in India |
The two can sit in one document. What matters is whether the required terms are there and binding, not the title on the front page.
The Article 28 terms an NDA usually lacks
Article 28(3) GDPR requires the processor contract to describe the processing and to include specific commitments. A typical NDA covers little of the list:
| Article 28 requirement | In a typical NDA? |
|---|---|
| Subject-matter, duration, nature and purpose, types of data and categories of data subjects | Not usually |
| (a) Processing only on the controller's documented instructions, including on transfers | Not usually |
| (b) Staff who process the data are committed to confidentiality | Often, in part |
| (c) The security measures required by Article 32 | Rarely in any detail |
| (d) The conditions for engaging sub-processors in Article 28(2) and (4) | Not usually |
| (e) Help with requests from data subjects exercising their rights | Not usually |
| (f) Help with security, breach notification and impact assessments under Articles 32 to 36 | Not usually |
| (g) Deleting or returning all personal data at the end of the service, at the controller's choice | Partly: return or destruction of confidential information |
| (h) Information to demonstrate compliance, and audits | Not usually |
Article 28(2) also bars a processor from engaging another processor without the controller's prior written authorisation. An NDA that lets you share information with "affiliates and subcontractors" does not supply that authorisation.
Roles decide which document you need
GDPR separates the controller, who decides the purposes and means of processing, from the processor, who processes on the controller's behalf.
The EDPB's guidance says the roles follow what each party actually does, not the labels in a contract.
A SaaS company can be a processor for the data its customers upload, and a controller for its own billing and account data. Work through the service activity by activity.
An NDA may be enough where no personal data changes hands, for example when sharing pricing, a product roadmap or source code.
Once you will host, access or support the customer's personal data for them, a processor contract is needed wherever Article 28 applies.
For a full review of a customer's DPA, including controller and processor roles in more depth, see our guide to an EU customer's DPA.
The Indian position under the DPDP Act
Section 8(2) of the Digital Personal Data Protection Act, 2023 lets a Data Fiduciary engage a Data Processor to process personal data on its behalf only under a valid contract.
Section 8(1) keeps the Data Fiduciary responsible for processing done on its behalf, irrespective of any agreement to the contrary. An Indian customer will therefore want processor terms it can rely on, not only a confidentiality promise.
The DPDP Act's main obligations take effect on 13 May 2027 under the phased schedule in the DPDP Rules, 2025. See our guide to the DPDP Act for GDPR-ready companies.
Transfers are a separate question
A processor contract does not by itself make an international transfer lawful. Identify hosting locations, remote support access and onward recipients, and assess the transfer route separately.
The European Commission has two sets of standard contractual clauses: one for controller-processor contracts under Article 28 (Decision 2021/915), and one for international transfers (Decision 2021/914).
Check which set a document labelled "SCCs" actually contains.
Make the DPA match the service you run
Ask the engineering and support teams to read the operational commitments before signature. A deletion promise must fit the architecture, including backups and any retention the law requires.
Separate what the product does today from what is on the roadmap. If the customer needs an access control before uploading data, record that dependency and resolve it first.
Keep one approved description of the processing, with a named owner. When the product adds an integration or changes support access, update the annex as well as the code.
Checking an NDA against a DPA request
- List the data. Record what personal data will enter the service, including logs, tickets and attachments.
- Fix the roles. Decide, activity by activity, whether you process for the customer or for your own purposes.
- Map the NDA against Article 28. Mark which required terms the NDA covers and which are missing.
- Check the Indian position. Where the DPDP Act applies, confirm a valid contract governs each Data Processor.
- Check transfers separately. Identify hosting locations, remote access and onward recipients, and the transfer route.
- Test the annex with engineering. Have product and support teams confirm they can deliver each commitment before signature.
Frequently asked questions
Is a DPA the same as an NDA?
No. Both can cover confidentiality, but a DPA governs the whole processing relationship: instructions, sub-processors, security, assistance, deletion and audits. An NDA usually covers only who may see the information.
Can an NDA ever replace a DPA?
Only if it actually contains the terms Article 28(3) requires, which a standard NDA rarely does. Where no personal data is processed for the customer, an NDA alone may be enough.
Must a DPA be a separate document?
No. The required terms can sit in the main agreement or an incorporated schedule. Check that they are binding, complete and consistent with the rest of the contract.
Does India's DPDP Act require a data processing agreement?
Section 8(2) says a Data Fiduciary may engage a Data Processor only under a valid contract, and section 8(1) keeps the Data Fiduciary responsible for that processing.
Can we sign the DPA and fill in its annexes later?
Avoid it. Article 28(3) requires the contract to describe the processing, so blank annexes leave unclear what was agreed. Complete the data, service and security details first.
The takeaway
Do not answer a DPA request with a confidentiality agreement. Map the NDA against Article 28, list what is missing, and make sure the processor terms describe the service your team actually runs.
To review a DPA request or an NDA, contact Saya & Associates with the customer's draft and a short description of the data your service will handle.
This article provides general information as at 23 October 2026. Whether GDPR or the DPDP Act applies, and what a contract must contain, depends on the parties, the processing and the countries involved. It is not legal advice.