Is a data processing agreement (DPA) required under the GDPR?

Many companies are faced with the question of whether they need to conclude a data processing agreement (DPA) with their tax advisor in accordance with Article 28 GDPR – especially in the case of payroll accounting.

There is considerable uncertainty, as differing opinions existed between data protection officers and supervisory authorities following the introduction of the GDPR. However, the legislator clarified this issue with the amendment to Section 11 of the German Tax Advisory Act (StBerG) on December 18, 2019, thereby confirming the legal opinion of the Federal Chamber of Tax Advisors.

As a general rule: Data processing on behalf of a controller only exists if the service provider acts under instructions (Art. 28 para. 3 GDPR).

Tax advisors, however, regularly act independently and without instructions on the basis of the Tax Advisory Act (Section 57 StBerG). Tax advisors are subject to professional confidentiality obligations under the StBerG as well as to the legally protected secrecy obligations under Section 203 of the German Criminal Code (StGB).

The newly worded Section 11 Paragraph 2 of the German Tax Advisory Act (StBerG nF) clarifies that the tax advisor acts unequivocally as an independent controller within the meaning of Article 4 No. 7 GDPR. Therefore, even when handling payroll accounting, there is no data processing on behalf of a controller within the meaning of Article 28 GDPR, as these services are also independent professional services.

For companies, this means that a data processing agreement with the tax advisor is not required. Instead, the tax advisor processes personal data as a separate controller within the meaning of Article 4 No. 7 GDPR. The respective processing is based on the relevant legal bases of Article 6 GDPR and Section 11 of the German Tax Advisory Act (StBerG nF).

HCSM helps you to solve tax and data protection issues in a practical and legally compliant manner.

Note: This article is for general information purposes only and does not replace individual tax advice.