Do photographers need a DPA (data processing agreement)?

If you use any tool that stores or processes client photos on your behalf — a gallery delivery platform, a cloud backup, a culling or editing service — you generally need a data processing agreement (DPA) with that tool. Under GDPR you’re the controller of your clients’ personal data; those tools are your processors, and a DPA is the contract that governs how they handle it. This is general guidance, not legal advice.

Controller vs processor, in one line

You decide why and how the photos are processed — you’re the controller. A platform that stores and serves them for you acts on your instructions — it’s a processor. GDPR expects controllers and processors to have a DPA in place.

What a DPA covers

What data is processed and for what purpose
That the processor only acts on your documented instructions
Security measures they commit to
Use of sub-processors (and where they are)
Help with data-subject requests and breach notification
What happens to the data when you leave

When you need one

Your delivery/gallery platform — yes, it stores client personal data. Ask for its DPA.
Cloud backup that holds client files — yes.
AI culling / editing services that upload client photos — yes.
A pure local workflow with no third party touching the files — a DPA isn’t the relevant instrument, though your other GDPR duties still apply.

How to actually get this done

You don’t draft it — the processor provides it. A GDPR-native platform offers a DPA on request, often as a standard document you countersign. If a vendor can’t produce one, that tells you something about how seriously they take data protection — and may be a reason an agency or school client can’t work with you through them.

The practical checklist

Ask each processor for its DPA and keep a copy.
Prefer processors with EU data residency and a clear sub-processor list.
Fold this into your broader GDPR baseline.

CuratePics provides a DPA on request and is GDPR-native with EU data residency. Request one →