If your business exchanges data with partners, suppliers or customers — for example statistics, customer lists or other data sets — it's a good idea to have written rules for what the recipient can actually use the data for. But this is where one of the most common legal mix-ups in this area happens: an ordinary data usage agreement is something entirely different from a GDPR data processing agreement, and using the wrong one means you risk genuinely missing a legally required document.

What is a data usage agreement?

A data usage agreement is a commercial agreement between two businesses that sets out what the recipient may do with data the other party makes available. That could be market data, statistics, technical data sets, or other material that isn't itself personal data. The agreement typically regulates what the data may be used for, whether the usage right is time-limited or exclusive, and what the recipient may not do — for example resell the data to a third party.

What is a GDPR data processing agreement — and why is it different?

If the data you're exchanging includes personal data — that is, information that can be linked to an identified or identifiable individual — a completely different, statutory framework applies. If one party processes personal data on behalf of the other, you're required to enter into a data processing agreement under Article 28 of the GDPR. This isn't optional the way an ordinary usage agreement is — it's a legal requirement, and a data processing agreement must, at a minimum, regulate a number of specific points that an ordinary usage agreement doesn't cover at all.

How do you decide which agreement you need?

  • If the data contains no personal data — for example pure business data, technical specifications, or aggregated statistics with no way to identify individuals — an ordinary data usage agreement is sufficient.
  • If the data contains personal data, and the recipient processes it on behalf of the other party — for example a supplier handling customer data for you — you must enter into a data processing agreement under GDPR Article 28, regardless of whether you also want an ordinary usage agreement alongside it.
  • If you're unsure, the safest default is to assume a data processing agreement is needed and get it confirmed by an advisor — the consequences of lacking a legally required data processing agreement are significantly greater than having a redundant usage agreement.

What should an ordinary data usage agreement include?

  • The material: A precise description of what data the agreement covers.
  • The recipient's usage right: What the data may be used for, and whether the right is exclusive, time-limited, or both.
  • Restrictions: That the data may not be resold or passed on to third parties without consent.
  • Ownership: That the agreement only grants a usage right — not a transfer of ownership of the data itself.
  • Confidentiality, duration and liability: What applies if the partnership ends, and who bears the risk if the data turns out to be flawed.

What should a GDPR data processing agreement include?

Beyond the commercial terms, GDPR Article 28 sets a number of specific minimum requirements for the content, including that the data processor may only process personal data on documented instructions, that confidentiality obligations are in place, that appropriate security measures are implemented, that use of sub-processors requires approval, and that data is deleted or returned once the partnership ends. See the full walkthrough, and download the template, in our data processing agreement (GDPR) under Documents (currently in Danish).

Might your business need both agreements at once?

Yes, that's actually quite common. If you exchange both ordinary business data and personal data as part of the same partnership, it can make good sense to enter into an ordinary usage agreement for the general data, and supplement it with a separate data processing agreement specifically for the part involving personal data. Mixing the two into one document risks making both unclear — and, at worst, deficient in relation to GDPR's specific requirements.

Frequently asked questions

Is a data usage agreement the same as a GDPR data processing agreement?

No. A usage agreement regulates what the recipient may generally do with data. A data processing agreement is a legally required document under GDPR Article 28 that specifically applies when someone processes personal data on behalf of another party.

What happens if I use an ordinary usage agreement when I actually needed a data processing agreement?

You're genuinely missing a legally required document, which can constitute a standalone breach of GDPR — regardless of whether the data processing itself is otherwise handled responsibly.

Can I download both types of agreement for free?

Yes, we have both as free templates under Documents (currently in Danish) — both a data usage agreement and a separate data processing agreement (GDPR).

Unsure which agreement your situation requires? Book a no-obligation call, or download the templates directly under Documents.

96