# Data Processing When Service Providers Access Servers

> Remote maintenance, patching, forensics: what a DPA under Art. 28 GDPR regulates when IT service providers access servers, and what to clarify before an emergency.

Source: https://phpsos.de/en/blog/auftragsverarbeitung-serverzugriff/  
As of: 25/10/2026  
Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6

**In short:** If an IT service provider accesses servers on which personal data resides, a data processing agreement (DPA) under Art. 28 GDPR is generally required. It stipulates that the provider acts only on instructions, maintains confidentiality, takes appropriate security measures, involves further partners only with authorization and reports data breaches without delay. Conclude the DPA before the emergency occurs. This page is general information and not legal advice.

## When Things Have to Move Fast, the Contract Is Often Missing

In the week after PHP2Shell, many companies brought in external help at short notice. An admin was to update PHP, an agency to restart the processes, a forensics team to examine logs. For this, outsiders got access to servers holding customer accounts, orders and form data. The question of the data protection legal basis on which this happened often arose only afterwards.

That is understandable, because speed counts in an emergency. But it is avoidable. With some preparation, both can be combined: fast help and a clean basis.

## When a DPA with the IT Service Provider Is Needed

Data processing exists when a provider processes personal data on behalf of and on the instructions of a controller. With web servers, the mere possibility of access is often enough: anyone working with root rights on a server can read the database with customer data, even if they do not intend to.

Typical situations with server access are:

- ongoing maintenance and updates by an agency or systems house,
- operation of the server by a host with managed services,
- emergency help, cleanup and restoration after an attack,
- forensic examination with copies of data carriers and logs,
- monitoring in which log data flows to the provider.

Short engagements count too. A remote session with screen sharing in which a technician just "takes a quick look" can show him customer data. A database export that is sent by email for troubleshooting is a disclosure. Precisely such occasions often run without a basis because they are not perceived as a project.

Whether data processing exists in a concrete case or another constellation, your data protection officer assesses. What matters is to ask the question at all before access is granted.

## What Art. 28 GDPR Requires in the Contract

Art. 28(3) GDPR lists mandatory content. In addition to subject matter, duration, nature and purpose of the processing, types of data and categories of data subjects, the processor must commit, among other things, to the following points. The right-hand column shows what that means in practice for server access.

| Obligation under Art. 28(3) | Practical meaning for server access |
|---|---|
| a) Processing only on documented instructions | Order in writing, for example via ticket: what exactly is to be done |
| b) Confidentiality of the persons deployed | only committed, individually known persons get access |
| c) Measures under Art. 32 | personal accounts, two-factor authentication, encrypted connections |
| d) Conditions for further processors | forensics or hosting partners only with authorization |
| e) Assistance with data subject rights | help when access or erasure affects the server |
| f) Assistance with Art. 32 to 36 | cooperation on security, notification and impact assessment |
| g) Deletion or return after completion | copies, images and exports are deleted or returned |
| h) Evidence and audits | logs of the accesses, information about measures |

In addition, Art. 33(2) GDPR requires the processor to notify the controller without delay of a data breach it learns about. For a provider that is currently examining a compromised server, this is no formality: it is often the first to see indications of data exfiltration. The deadline and the further course of the notification to the supervisory authority are explained in [GDPR Reporting Obligation: 72 Hours After the Incident](https://phpsos.de/en/compliance/dsgvo-meldepflicht-72-stunden/).

## Organizing Access in a Data-Protection-Compliant Way

A signed DPA is the basis. Whether the commitments are kept is decided in day-to-day practice. These steps have proven themselves:

1. **Separate, personal access** for each person at the provider, never shared admin accounts. How to secure them is covered under [Two-Factor Authentication for Admin Access](https://phpsos.de/en/ratgeber/zwei-faktor-admin/).
2. **Limit in time:** Deactivate access for an engagement after completion, review permanent accounts regularly.
3. **Log:** Record logins and commands of the provider accounts so that it remains traceable who did what.
4. **Work with data minimization:** Copy only the necessary data for analyses, store copies encrypted, record storage location and deletion date.
5. **Document completion:** Access withdrawn, copies deleted or handed over, confirmation in writing.

> **Important:**
> A forensic examination often creates complete images of servers, including all customer data. Regulate in advance where such images are stored, who accesses them and when they are deleted, without endangering the preservation of evidence.

## Conclude the DPA Before the Emergency

The best time for the DPA is a quiet day. Name the providers that are to act in an emergency, that is, host, agency and, where applicable, a team for incident handling and forensics, and conclude the contracts with them in advance. Also record which further partners the provider may use.

File the signed contracts where the emergency plan is kept, and note in the contact list with whom a DPA exists. The remaining security obligations, such as update deadlines and evidence, belong in the service contract; more on this under [IT Service Provider Contracts: Defining Security Obligations Clearly](https://phpsos.de/en/blog/dienstleistervertrag-sicherheit/). For all legal questions, your data protection officer and a lawyer are the right contacts.

## How does PHP SOS help?

- Before the first access, we clarify which data resides on the affected systems and coordinate the framework with your data protection officer.
- We work with personal, logged access and document every intervention traceably.
- We name the specialized partners we would involve, for example for [IT forensics](https://phpsos.de/en/leistungen/it-forensik/), so that you can decide in advance.
- After completing an [incident response](https://phpsos.de/en/leistungen/incident-response/), we confirm in writing the withdrawal of access and the deletion or handover of all copies.

**Conclusion:** Data protection and fast help are not mutually exclusive if the basis is in place beforehand. A DPA with the service providers for an emergency belongs in every emergency preparedness plan. This page is general information and not legal advice.


## Frequently asked questions

**Is every remote maintenance session data processing?**  
Not automatically. What matters is whether the provider processes personal data on your behalf or can access it. With web servers holding customer accounts, orders or forms, this is usually the case. Your data protection officer makes the classification in the individual case.

**Can I still conclude a DPA during an incident?**  
It is possible, but under time pressure there is often no calm for a review. It is better to conclude the DPA in advance with providers who are to act in an emergency. Then the work can start immediately.

**Does the provider have to inform me if it notices a data breach?**  
Yes. Under Art. 33(2) GDPR, the processor notifies the controller of a personal data breach without undue delay after becoming aware of it. The notification to the supervisory authority remains the controller's responsibility.

**May the provider bring in further partners, for example for forensics?**  
Under Art. 28(2) GDPR only with the controller's prior written authorization, which can be given specifically or generally. With a general authorization, the provider must inform you of changes so that you can object.

## Sources

- [GDPR Art. 28: Processor](https://dsgvo-gesetz.de/art-28-dsgvo/)
- [GDPR Art. 33](https://dsgvo-gesetz.de/art-33-dsgvo/)
- [BSI IT-Grundschutz (German IT baseline protection)](https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/IT-Grundschutz/it-grundschutz_node.html)