Your Agency Is a Data Processor. Your Contract Should Say So

You handed your social media agency your customer email list, or let them install a Meta pixel, or gave them a CRM export to build a lookalike audience. Nobody signed anything about data protection. If your contract never says the word “processor,” the compliance exposure sitting on that arrangement is quietly yours, not the agency’s.

The moment this becomes a legal relationship, not just a vendor relationship

The trigger is not the retainer. It is the moment personal data actually moves: an email list handed over for a campaign, a hashed customer list uploaded for a lookalike audience, or pixel data flowing off your site into an ad platform your agency manages. The instant that happens, you are very likely a data controller and your agency is very likely a data processor. You decide why the data is collected. The agency acts on your instructions to run campaigns with it. That division of roles is what the law looks at, regardless of what your retainer calls either party.

Most agency-authored contracts protect the agency’s own liability, not your compliance position. Data processing terms are a different document, and if nobody asked for it, it is likely missing.

What GDPR Article 28 actually requires when a processor is involved

If any of the data involved belongs to people in the EU or UK, GDPR Article 28 applies, and it is binding, not best-practice advice. It requires a written Data Processing Agreement, or DPA, covering the subject matter, duration, nature and purpose of processing, the data types and people involved, and confidentiality, security, deletion, and audit rights. Here is the client-favorable version of each clause against the agency-favorable one.

• Subject matter and duration. Client-favorable: named campaign activities with a term matching the contract. Agency-favorable: broad language like “marketing services” that outlives the engagement.
• Data types and categories. Client-favorable: an explicit list, email addresses, phone numbers, pixel events. Agency-favorable: a vague “customer data” reference with no list.
• Security and audit rights. Client-favorable: commitments you can verify. Agency-favorable: “industry standard security,” which commits to nothing measurable.
• Deletion. Client-favorable: automatic and dated at contract end. Agency-favorable: only “upon written request,” shifting the burden onto you.

If your customers are US-based instead: the CCPA service provider angle

If your customers are mostly in the United States, GDPR generally does not apply directly, since it turns on where the people are, not where your business is based. California’s framework, the CCPA as amended by the CPRA, builds a similar relationship with different terms: the “business” instead of the controller, the “service provider” instead of the processor, and its own contractual conditions before personal information can be shared with a service provider.

Treat this as general legal context, not legal advice. A brand with EU customers, UK customers, or a physical EU presence should not assume CCPA coverage is enough alone.

The pixel is the part everyone forgets to name

An email list export feels like handing over data. A Meta or TikTok pixel does not, which is why it is the most commonly missed piece of this. The pixel sits on your own site and sends visitor behavior back to the platform: pages viewed, purchases, sometimes hashed identifiers. Your agency, by directing what that pixel tracks and how the data is used for targeting, is instructing that processing even though the data never sits on the agency’s servers.

That is where the wrong assumption creeps in. Because the agency never stores the data on infrastructure it owns, it is easy to conclude it has no data obligations here. That reasoning runs backwards: instructing what happens to the data is what makes someone a processor, regardless of whose servers it touches.

Picture, as an illustration, a brand that discovers its agency built a lookalike audience from a full customer list, not just site visitors, only when a customer files a data access request. The contract that would have caught this is the one nobody wrote.

What to actually ask for before you sign, or before the next renewal

• A signed Data Processing Agreement as a precondition of data access, not something negotiated after the fact.
• A written list of exactly what data categories the agency will touch, email addresses, phone numbers, pixel events, CRM fields, rather than a general “marketing data” clause.
• A stated deletion or return timeline, a specific number of days, not “promptly” or “as reasonably requested.”
• A subprocessor disclosure requirement, since many agencies route data through a media buying platform, an analytics tool, or a subcontractor you have never heard of.

Why the agency probably will not raise this first

This is an incentive gap, not a character flaw. An agency’s standard contract was likely drafted by counsel focused on limiting the agency’s own liability, not covering data terms.

Asking for a DPA is a normal, unremarkable request, and a competent agency should produce one quickly. Confusion or a vague reassurance instead of an actual document is itself useful information about how the agency handles data.

See also what to check in a social media agency contract, who owns the ad account when an agency runs your paid social, and who owns your social accounts when an agency runs them.

Browse vetted agencies, or if you run one, list your agency free.

FAQ

Does this apply if my business is US-only with no EU customers?

GDPR turns on where the people whose data you hold are located, not where your business is based, so a US-only base with no EU or UK visitors generally falls outside GDPR. CCPA or CPRA’s service provider framework can still apply if your business meets California’s thresholds, a question for your counsel.

Is a general NDA enough to cover this?

No. An NDA protects confidentiality generally. A Data Processing Agreement covers different obligations, like what happens to the data after the contract ends, which an NDA does not address.

What if the agency says its standard contract already covers this?

Ask to see the specific clause, then check it against the Article 28 list above: a deletion timeline, subprocessor disclosure, and the actual data categories in scope.

Who is liable if the agency mishandles the data?

GDPR allows both controller and processor to face independent liability, and a controller cannot point to the processor’s failure to escape its own obligations. This is general legal context, not a determination for any specific situation.

Sources

• GDPR Article 28, Processor, fetched 2026-09-09
• GDPR Article 82, Right to compensation and liability, fetched 2026-09-09
• California Attorney General, California Consumer Privacy Act (CCPA), fetched 2026-09-09