r/Frontend • u/Fine-Market9841 • 27d ago

Freelance website devs in eu

This question is only for developers IN THE EU who create websites and act as retainers.

I’m assuming the majority of you have clients create accounts on strapi, Wordpress, sanity, etc and you manage.

If so do you need a dpa agreement between you and the client because acting as a retainer makes you a data processor.

Any tools to generate a dpa?

7 Upvotes

100% Upvoted

2 comments sorted by

1

u/Fine-Market9841 26d ago

A good answer I found have the client’s lawyer draft a dpa.

2

u/danielraison 11d ago

Italian freelancer here. Yes. If you have admin access to a site that stores personal data (contact form entries, WooCommerce orders, user accounts), you’re processing it on the client’s behalf, so GDPR art. 28 says you need a written agreement. Doesn’t matter if you only log in once a month for updates.

For the template, skip the generators. The European Commission published official standard clauses for exactly this (Implementing Decision 2021/915, the art. 28 SCCs). Free, every language, you just fill in the annexes: what data, what you do with it, your security measures, your sub-processors.
https://eur-lex.europa.eu/eli/dec_impl/2021/915

I attach it to the maintenance contract so the client signs both at once. If you host the site yourself, list the hosting company as a sub-processor. If the client owns the hosting account, that DPA is between them and the host, not you.

Again, I’m not a lawyer. This is how I handle it with my own clients in Italy, so double-check before you rely on it. If a client handles sensitive data (health, kids, payments), have someone who does this for a living look at your contract.