Most agencies are not in the data privacy business, but data privacy law applies to them anyway. The moment an agency runs an email campaign, manages a customer database, or builds a website that collects information, it's processing personal data on behalf of clients. That makes it a data processor under most modern privacy regimes, with real legal obligations and real risk if it gets things wrong. This guide covers what agencies need to do to comply with GDPR, CCPA and the growing set of US state privacy laws. It is general guidance, not legal advice.
In this guide:
- The agency's role under GDPR, CCPA, and similar laws (controller vs processor)
- The data processing addendum (DPA) every agency needs with clients and vendors
- How to map data flows so you actually know what you're handling
- Practical compliance steps for marketing, creative, and development work
- Operational habits that prevent the most common privacy violations
The point isn't to become a privacy lawyer. It's to set up the basic compliance infrastructure that lets you serve clients across regulated jurisdictions without creating legal exposure for them or yourself.
The privacy laws that apply to agencies
A handful of laws drive most agency compliance work today.
GDPR (General Data Protection Regulation): EU regulation governing the personal data of people in the EU. It applies beyond the EU's borders, so a US agency processing that data for a client can be in scope.
UK GDPR: The UK's retained version of GDPR, applied to people in the UK, with some differences in detail.
CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act): California state law with broad consumer rights for personal information.
State-level US laws: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and a growing list of others. Each is similar in spirit but different in detail.
PIPEDA (Canada): Federal privacy law for commercial organizations.
LGPD (Brazil): GDPR-inspired privacy law for Brazilian residents.
For most US agencies, building to GDPR and CCPA standards, plus a baseline for other state laws, covers most practical requirements.
Controller vs processor
The concept that shapes an agency's obligations most is the distinction between a controller and a processor.
Controller: Decides what personal data is collected and why. Bears primary legal responsibility.
Processor: Handles personal data on behalf of a controller, following the controller's instructions. Has narrower but still real obligations.
For most agency engagements, the client is the controller and the agency is the processor. The agency processes the client's customer data to send emails, manage CRM records, run ads, build databases, and so on.
But agencies also act as controllers for their own data: their own employees, prospects, leads, and marketing contacts. That dual role requires two parallel compliance tracks.
The data processing addendum
The core compliance document for an agency is the Data Processing Addendum (DPA). It's a formal contract between the controller (client) and processor (agency) that defines how personal data will be handled.
A standard DPA includes:
- Categories of personal data being processed
- Categories of data subjects (customers, employees, prospects)
- Purpose and duration of processing
- Security measures the processor will implement
- Restrictions on subprocessors (and the process for approving them)
- Data subject request handling procedures
- Breach notification timelines
- Data return or deletion at end of contract
Sign a DPA with every client whose data you process. Sign one with every vendor that processes data on your behalf (email tools, analytics platforms, hosting providers).
Most major SaaS vendors publish standard DPAs. Sign them as part of vendor onboarding.
Mapping your data flows
Before you can comply with anything, you need to know what data you have, where it lives, who has access to it, and who it's shared with. This is called a data flow map or data inventory.
A simple data flow map for an agency includes:
Data sources: Where does personal data enter your systems? Forms on client websites, CRM imports, lead lists, employee records.
Data storage: Where does it live? Your CRM, project management tool, email platform, file storage, local devices.
Data processing: What do you do with it? Send marketing emails, run ad campaigns, analyze behavior, build reports.
Data sharing: Where does it go? Subprocessors, analytics platforms, ad networks, client systems.
Data retention: How long do you keep it? Active campaign data, archived projects, deleted clients.
A thorough data flow map takes a few days to build and a half-day per quarter to maintain. It's the foundation of every other compliance activity.
GDPR requirements
GDPR (and UK GDPR) can apply to your agency wherever it is located: for example, when you process personal data on behalf of an EU client, or when you offer services to, or monitor the behavior of, people in the EU.
Key obligations for processors:
Lawful basis: The controller must have a lawful basis for processing (consent, contract, legitimate interest, legal obligation, vital interest, public task). Your job as a processor is to follow the controller's lawful basis, not establish your own.
Data subject rights: Individuals have rights to access, correct, delete, restrict, port, and object to processing of their data. As a processor, you must help the controller fulfill these requests.
Security: Implement appropriate technical and organizational security measures. This includes access controls, encryption, regular testing, and breach response.
Subprocessor management: You may not engage subprocessors without controller approval. Maintain a current subprocessor list and notify clients of changes.
International transfers: Transferring EU personal data outside the EU/EEA requires appropriate safeguards, typically Standard Contractual Clauses (SCCs).
Records of processing: Maintain records of the processing activities you carry out for each controller.
Breach notification: Notify the controller without undue delay after you become aware of a personal data breach. Many DPAs set a specific window, such as 24 to 48 hours, because the controller itself generally has 72 hours to notify the regulator.
Data Protection Officer: Required when your core activities involve large-scale, regular and systematic monitoring of individuals, or large-scale processing of special categories of data. Most agencies are not in that position, but check if you do large-scale tracking or profiling work.
CCPA / CPRA requirements
CCPA, as amended by CPRA, applies to for-profit businesses that handle personal information of California residents and meet at least one threshold: annual gross revenue above an inflation-adjusted limit (originally $25 million), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing personal information. Check the California Privacy Protection Agency for current figures.
For agencies, the most relevant CCPA obligations:
Service Provider status: Agencies typically qualify as "Service Providers" under CCPA (similar to processors under GDPR), which limits their obligations and exempts certain data sharing from being treated as a "sale" or "sharing."
Service Provider contracts: To qualify as a Service Provider, the agency-client contract must include specific terms restricting use, sale, and sharing of personal information.
Consumer rights handling: Help clients respond to consumer requests for access, deletion, correction, and opt-out.
Sensitive personal information: Additional restrictions apply to processing of sensitive personal information.
Do Not Sell / Do Not Share: For ad-tech and tracking activities, the agency must respect consumer opt-out signals on behalf of the client.
The standard pattern: include CCPA-compliant Service Provider language in your DPA, and ensure your operational practices match what you've contracted.
State-level compliance
The growing list of US state privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, and more) follow a similar pattern: define personal data, establish consumer rights, require contracts with processors, and impose specific obligations on regulated activities like targeted advertising and profiling.
For most agencies, the practical approach is:
- Build operations to the highest applicable standard (usually GDPR or CCPA)
- Maintain awareness of new state laws and their effective dates
- Update DPAs and privacy policies as new laws come into effect
- Avoid making compliance promises that vary state by state
Maintaining different practices for each state quickly becomes unmanageable. Building to the highest standard and applying it everywhere is simpler and safer.
Practical compliance for common agency activities
The legal frameworks above translate into specific operational requirements for the work agencies actually do.
Email marketing
- Confirm the client has obtained valid consent or has a lawful basis for the contacts being emailed
- Use unsubscribe links in every commercial email
- Honor unsubscribe requests promptly (within 10 business days under CAN-SPAM; other laws and mailbox providers can expect faster)
- Don't share email lists across clients
- Maintain suppression lists per client
CRM and database management
- Confirm the client owns the data and has the right to share it with you
- Limit your access to what's necessary for the engagement
- Use role-based access controls within your team
- Encrypt data at rest and in transit
- Have a documented deletion process when engagements end
Web development
- Implement cookie consent banners that comply with applicable law
- Default to no tracking until consent is given (in jurisdictions that require this)
- Document third-party scripts and their data flows
- Build privacy policies that match the actual data flows of the site
- Implement Do Not Track and Global Privacy Control respect where required
Analytics and tracking
- Use server-side tracking where possible to reduce reliance on cookies
- Implement consent mode in Google Analytics, Meta, and similar platforms
- Honor opt-outs across the full tracking stack
- Document what data flows to which platforms in your client's privacy policy
Paid media
- Use proper consent management for retargeting and lookalike audiences
- Honor opt-out signals when serving ads
- Avoid uploading PII (or hash it properly when uploading customer match audiences)
- Document data flows in vendor DPAs
Creative and design work
Creative work usually doesn't involve personal data directly, but watch for:
- Stock photography rights including model releases
- User research recordings and transcripts (treat as personal data)
- Survey responses and form submissions
- A/B testing data
Vendor management
Your vendors are subprocessors under GDPR and Service Providers under CCPA. Each one needs:
- A signed DPA
- A clear understanding of what data they will process
- Documentation in your subprocessor list (which clients see)
- Periodic review of their security practices
Major vendors to set up DPAs with:
- Email platforms (Mailchimp, Klaviyo, ActiveCampaign, etc.)
- CRMs (HubSpot, Salesforce, Pipedrive, etc.)
- Project management tools (Asana, Monday, Notion, etc.)
- Cloud storage (Google Workspace, Microsoft 365, Dropbox, etc.)
- Analytics (Google Analytics, Mixpanel, Amplitude)
- Hosting and infrastructure (AWS, Cloudflare, Vercel)
Keep the subprocessor list and DPA status somewhere your whole team can find it, next to the client contracts it relates to.
Breach response
A data breach is any unauthorized access, loss, or disclosure of personal data. Even small incidents can trigger notification requirements.
A basic breach response plan:
Detect: Know how you'll find out about a breach. Monitoring, vendor notifications, employee reports.
Contain: Stop the breach from spreading. Revoke access, isolate systems, change credentials.
Assess: Determine what data was affected, how many people, and what the risk is.
Notify: Notify affected clients without undue delay and within any window your DPAs set, then work with them on regulator and individual notifications. Under GDPR, the controller generally has 72 hours from awareness to notify the regulator.
Document: Record everything: what happened, when, what data was involved, what was done.
Remediate: Fix the underlying issue and update controls.
For larger agencies, build this plan in advance. Practice it. Don't wait until a breach happens to figure out who calls whom.
Building a privacy program
The core elements of a working privacy program for an agency:
- Policies: Privacy policy for your own website, internal data handling policy, breach response policy.
- Contracts: Standard DPA template, signed DPAs with all clients and vendors, NDA templates for contractors.
- Inventory: Current data flow map, subprocessor list, vendor DPA tracker.
- Training: Annual training for all staff on data handling basics.
- Operations: Access controls, encryption, secure deletion, retention policies.
- Response: Breach response plan, data subject request handling procedures.
- Review: Annual privacy program review with legal counsel.
This isn't a six-month enterprise project. A small or mid-sized agency can stand up a basic compliance program in a few weeks of focused work, then maintain it with a few hours per quarter.
When to get legal help
You can build the basics from templates and guidance like this. Bring in a privacy lawyer when:
- You're entering a new market with different privacy laws
- A client is requiring custom DPA terms
- You're considering a new product or service that handles new categories of data
- You're processing sensitive data (health, financial, biometric)
- You experience a breach
- You receive a regulator inquiry or consumer complaint
- You're going through diligence for a sale or significant investment
A privacy lawyer's time is expensive but well worth it for these situations.
Final thoughts
In privacy compliance, the gap between doing nothing and doing the basics is large, and the gap between the basics and perfection is much smaller. The basics cover most of the practical risk for a fraction of the effort.
Sign DPAs. Map your data. Use the right vendor agreements. Train your team. Have a breach response plan. Update annually.
That's a working privacy program. It's not glamorous, but it lets you say yes to clients in regulated markets.
Frequently asked questions
Do US-based agencies need to comply with GDPR?
Often, yes. GDPR can apply when you process personal data on behalf of an EU client, or when you offer services to or track the behavior of people in the EU, regardless of where the data is stored. Agencies that run campaigns or websites aimed at EU audiences are usually in scope. The highest tier of fines is up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher (GDPR Article 83).
What is a data processing agreement (DPA)?
A DPA is a contract that defines the agency's obligations when handling client data on their behalf. It must specify what data is processed, how it is protected, who has access, and what happens at engagement end. Sign a DPA with every client whose work involves personal data.
How do agencies handle client data when an engagement ends?
Document a data deletion or return process in the contract: for example, a 30-day window after the engagement ends, then secure deletion with written confirmation to the client. Keep your own compliance records (DPAs, deletion confirmations) for as long as your contracts and local record-keeping rules require.
What vendor agreements does an agency need for compliance?
Sign DPAs with every sub-processor that touches client data: hosting, analytics, email tools, CRMs, project management, and any AI tools. Maintain a vendor inventory with current DPA status, reviewed annually. A missing DPA is one of the easiest gaps for a client's security review to find.
How much does GDPR or CCPA compliance cost an agency?
The main costs are legal review of your DPA and privacy policy templates, staff time to build the data map and vendor inventory, training, and any tooling for consent management. Get quotes from a privacy lawyer for the template work; the rest is mostly internal time. Agencies handling sensitive data, or required to appoint a Data Protection Officer, should budget for more.
Want client contracts and project files in one place? AgencyPro's documents feature (Pro plan) handles quotes, proposals and contracts alongside client work in the client portal. Book a demo.