If Your Agency Touches Customer Data, You Need a Data Processing Agreement

Your social media agency asks for a CRM export to build a lookalike audience, or wants pixel access on your site to track visitors. You pull up the paperwork signed at kickoff and it is an NDA. That document protects your trade secrets and unreleased plans. It says nothing about who is liable if that customer list ends up somewhere it should not.

An NDA and a DPA answer different questions

A non-disclosure agreement governs confidential business information: strategy documents, unreleased campaign plans, pricing you have not made public. Its remedy, if broken, is usually damages or an injunction, since the harm it addresses is disclosure to a third party.

A data processing agreement governs how personal data belonging to your customers is collected, stored, used, and deleted by a party handling it on your behalf. It exists because privacy statutes require a written contract with specific terms whenever a controller hands personal data to a processor. Signing only an NDA before handing over a customer list or turning on pixel access leaves no contract defining what the agency can do with the data, how long it can keep it, or what happens if it is exposed.

What actually triggers the need for one

• A CRM export or customer list handed to the agency for lookalike or custom audience building.
• Pixel or conversions API access on your site or app, sending visitor and customer events into the agency’s ad accounts. This access is covered from an ownership angle in who owns the ad account when an agency runs your paid social.
• A shared inbox, DM tool, or chat platform where the agency can read message content from real customers, not brand-side notes.
• The rule underneath all three: if the agency can see, download, or process personal data belonging to your customers rather than your brand, that is a data processing relationship, not a confidential one.

What a data processing agreement actually says

• Who is the controller and who is the processor. The brand decides why data is processed, the agency processes on the brand’s instructions. This allocation determines liability when something goes wrong.
• The specific purposes the agency may use the data for, so it cannot repurpose a list for another client’s audience.
• Data retention and deletion terms once engagement ends, and whether the agency must confirm deletion or return the data.
• Sub-processor disclosure: if the agency’s ad platform, CRM tool, or subcontractor also touches data, that party has to be named or permitted in the agreement.
• Breach notification terms specifying how fast the agency must tell you if data is exposed.

Why an NDA does not cover any of this even when it feels thorough

Picture an agency that signs a strong NDA promising never to disclose your customer list to competitors, then uploads that list to a third ad platform to build a lookalike audience for a different purpose than agreed. That is not a breach of the NDA, because the NDA never addressed processing purpose, only disclosure to outsiders. An NDA breach requires someone to have told a third party something confidential. Mishandling data, over-retaining it, or using it beyond the agreed purpose usually is not a disclosure to anyone, so the NDA never triggers. This is illustrative reasoning about contract scope, not a claim about any real agency’s conduct.

What this looks like when a brand asks for one

Ask the agency directly whether they have a standard DPA they can execute. Agencies that regularly handle customer data for retargeting usually already have one drafted. If the agency has never been asked for one before, that is worth noting and raising with whoever handles compliance internally, though not disqualifying on its own. Smaller agencies without in house legal may need you to supply the DPA yourself, which is normal and does not reflect badly on the agency. The same access question is covered from an ownership angle in who owns your social accounts when an agency runs them.

Where legal or compliance functions fit into a purely marketing decision

Here is the moment this usually surfaces: an agency requests a customer list or pixel access for retargeting, and someone in legal or compliance asks what paperwork covers that. The marketing owner of the agency relationship is rarely the right person to approve a DPA alone, since it is a legal instrument with liability consequences outside marketing’s usual scope. Route it to whoever handles vendor contracts or privacy compliance internally, before access is granted, not after.

Get the paperwork in place before you hand over access

A DPA is one clause inside a larger document, and if you have not worked through what to check in a social media agency contract yet, that is the place to start before narrowing in on this one. If you are still evaluating agencies, browse vetted agencies and ask this question during the pitch process rather than after signing. If you run a social media agency and this is already part of how you operate, list your agency free so brands doing this diligence can find you.

FAQ

Does my NDA already cover this if it mentions confidential information broadly?

Breadth of language is not a substitute for the specific terms a DPA requires: purpose limitation, retention and deletion, sub-processor disclosure, and breach notification. A broadly worded NDA can still never touch any of those, because it answers a different question than a DPA answers.

What kind of agency work does not require a DPA?

Work that never touches personal data about your own customers: pure content creation, brand strategy, or work confined to your public assets, with no customer list, pixel, or inbox access involved. The trigger is access to customer data, not the agency relationship itself.

Who normally drafts the DPA, the brand or the agency?

Either can. Larger agencies that regularly handle retargeting data usually have a standard DPA ready. Smaller shops without in house legal may need the brand to supply the document, which is not a red flag by itself, just a difference in legal infrastructure.

Does this apply even with no cross border data transfer?

Yes. The trigger for needing a DPA is processing personal data on another party’s behalf, not moving data across a border. Cross border transfer adds separate obligations, but is not what creates the need for a DPA in the first place.

Sources

• GDPR Article 28, processor obligations, checked 2026-09-09.
• GDPR Article 4, definitions including controller and processor, checked 2026-09-09.
• California Attorney General, CCPA guidance, checked 2026-09-09.
• FTC business guidance on data security, checked 2026-09-09.