Data processing agreements for webinar tools

When you use a webinar tool, you hand it your attendees’ data: names, email addresses, chat messages, viewing times. Under the GDPR that’s only in order if you have a data processing agreement with the provider, often shortened to DPA. This article explains when a webinar tool needs one, what it has to contain and how to review it properly in about half an hour rather than just ticking a box. It takes an EU perspective; the UK has kept an almost identical requirement in its own version of the GDPR.

When a webinar tool is a processor

The GDPR distinguishes between the controller, who decides why and how personal data is processed, and the processor, who handles data on the controller’s behalf and on their instructions. For your webinar, you’re the controller. You decide who to invite, what to ask for at registration and what happens with the data afterwards.

A webinar tool is usually your processor. It stores registrations, sends confirmations, plays the session and shows you the figures, but it does all that for you, not for its own purposes. The same is often true of other services around your webinar:

• the host of your registration page, if it isn’t inside the tool,
• an email delivery service, if you use a separate one,
• an AI service you contract directly, for example to answer chat questions.

Not every service provider is automatically a processor. Payment providers, for instance, often act as controllers in their own right because the law requires them to check payments. And if a provider also uses your attendees’ data for its own ends, it’s no longer purely a processor for that part. A DPA alone doesn’t cover that.

Whether the service is free or paid makes no difference. As soon as personal data is processed on your behalf, Article 28 of the GDPR requires a contract.

What a DPA has to cover

Article 28(3) sets out the minimum content. First, the basic facts of the processing:

• subject matter and duration,
• nature and purpose,
• type of personal data,
• categories of people concerned,
• the controller’s obligations and rights.

Then come the processor’s obligations. In plain terms:

The contract has to be in writing, and electronic form is enough (Article 28(9)). With online tools it’s normal for the provider to offer a standard agreement in your account that you accept with a click or download. That’s fine. The European Commission has also published standard contractual clauses for the controller-processor relationship, and some providers use them.

Reading the security annex

The annex on technical and organisational measures is easy to skip, yet it describes how your attendees’ data is actually protected. Look for concrete statements rather than generic phrases:

• Encryption in transit and ideally at rest.
• Access control, meaning who at the provider can see customer data and how that’s logged.
• Backups, where they’re kept and for how long.
• Deletion, including from backups, with clear time frames.
• Account protection, such as two-factor sign-in.
• Incident handling, meaning who does what if there’s a breach.

A line like “We take all necessary state-of-the-art measures” tells you very little. A short but specific list is a much better sign.

Keeping an eye on sub-processors

Hardly any webinar tool does everything itself. Behind it there are usually other providers: a data centre, an email delivery service, storage for videos and slides, a support desk and, for AI features, a language model or a synthetic voice service. These are sub-processors.

Article 28(2) and (4) set out how this works:

• The provider may only engage sub-processors with your prior authorisation. A general authorisation in the DPA, together with a list of current sub-processors, is common.
• With a general authorisation, the provider must tell you about planned changes, and you must be able to object.
• It has to impose the same data protection obligations on its sub-processors and remains liable to you if they fail to meet them.

In practice, ask to see the list and check it against the features you actually use. Does each entry name the purpose and the location? How will you hear about changes: by email, or only through a page you have to keep checking yourself? AI features deserve a close look, because they often bring in providers outside the EU. For more on that, see AI and data protection in webinar tools.

If you use your own AI key inside a tool, the chain changes. You then contract with the AI provider yourself, and it’s no longer just a sub-processor on the tool’s list. The pros and cons are covered in Bring your own AI key to a webinar tool.

Data leaving the EU

If data is transferred to a country outside the EU and the European Economic Area, you need an additional legal basis under Articles 44 onwards of the GDPR. That’s not only about servers abroad. Remote access, for example by a support team in a third country, can count as a transfer too.

The usual bases are:

• an adequacy decision by the European Commission for the destination country. For the US, the EU-US Data Privacy Framework has applied since July 2023, but only to companies certified under it.
• the Commission’s standard contractual clauses, combined with an assessment of whether the data is adequately protected in the destination country.

A good DPA says clearly whether data is transferred, where to and on what basis. If it says nothing, ask. A provider with servers in the EU makes things easier, but the question is only fully answered when its sub-processors work in the EU as well.

Checklist before you sign

Set aside half an hour for a new provider and work through these points:

• There’s a DPA, and you know where to find it in your account or where you’ve filed it.
• The data and purposes described match what you actually do, such as registrations, emails, chat and reporting.
• The provider commits not to use your attendees’ data for its own purposes, including training AI models.
• The security annex is concrete and covers encryption, access control, backups and deletion.
• There’s a list of sub-processors with purpose and location.
• You’re told about changes to that list and can object.
• Transfers outside the EU are named and covered by a legal basis.
• The provider will notify you of data breaches without undue delay.
• You can answer access requests, delete individual attendees and export data.
• After the contract ends, data is deleted or returned within a clear time frame.

What stays with you

Signing the DPA doesn’t end your part. A few tasks remain yours:

• Record of processing activities (Article 30): add the webinar tool and its role.
• Privacy notice: name the tool as a recipient and mention any transfer outside the EU. What belongs on the registration page is covered in Legal notice and privacy policy for webinar pages.
• Follow changes: read notices about new sub-processors rather than filing them unread.
• Use the settings: set deletion periods and only ask for what you need. A clean sign-up process is described in Double opt-in for webinar registrations.
• Tidy up when you switch: export what you have to keep and have the rest deleted at the old provider.

Breaches of the Article 28 obligations can lead to fines for controllers and processors alike. Day to day, though, the bigger benefit is that a good DPA means you always know where your attendees’ data is.

Frequently asked questions

Do I have to sign the DPA?

It has to exist in writing, and electronic form is enough. Accepting it with a click in your account or signing a document electronically is usually sufficient. Save a dated copy.

What if a provider doesn’t offer a DPA?

Then don’t use the tool for personal data. Ask first, as the agreement is sometimes tucked away in the terms. If there really isn’t one, take that as a clear warning sign.

Can I simply accept the provider’s standard DPA?

Yes, that’s normal with online services. Read it anyway, and check the sub-processors, transfers outside the EU and whether the provider uses data for its own purposes.

Do I need a DPA for a free tool?

Yes. Under the GDPR, the price is irrelevant. What matters is whether the service processes personal data on your behalf.

A contract that brings clarity

A DPA is more than paperwork. It makes you and the provider write down who does what with your attendees’ data, where it’s kept and how it’s removed again. Review it properly once, and you have a solid footing for every webinar that follows.

This article is general information as of June 2026, not legal advice. For your specific situation, speak to a lawyer or your data protection officer.