Can the agency use the data of the brand's end customers to improve its own services or train models?

No, unless expressly authorised by the brand and, where applicable, with an adequate legal basis regarding the end data subject. The processor role prohibits using the data for its own purposes other than those the controller has instructed. That explicitly includes: not cross-referencing the data of several brand-clients to build internal benchmarks, not using the personal data to train the agency's own AI models, not reusing one client's contacts to prospect other clients and not building its own databases by extracting data from clients' CRMs. If the agency wants to obtain this kind of analytical value, it must agree it expressly with each brand-client, or else work exclusively with anonymised or aggregated data with no possible identification. Aggregated analysis of client data to improve its own campaigns is usually legitimate if provided for in the contract; any use unrelated to the contracted service is not.

Marketing agencies as data processors: contracts and responsibilities

Q: Is a marketing agency a controller or a processor with respect to the data of its clients' end customers?

The general rule is that the agency acts as a processor (art. 28 GDPR) with respect to the data of its brand-clients' end customers. When an agency manages the brand's subscriber list, sends emails on the brand's behalf, segments its CRM or configures its retargeting campaigns, it is processing data on behalf of the controller (the brand), which is the party that maintains the relationship with the end data subject, decided to acquire that customer and defined the purposes of the communication. The agency executes what the brand instructs. That said, the agency is a controller with respect to its own data: its own commercial contacts, prospects in its sector, staff, suppliers. This duality must be regulated contractually with a DPA or art. 28 GDPR addendum for each brand-client.

Q: What must a marketing agency sign with its brand-client when starting the engagement?

In addition to the usual commercial services contract, a processing addendum or contract is needed with the minimum content of art. 28(3) GDPR: subject matter of the processing (specific services contracted), duration (term of the engagement), nature and purpose (campaigns, email marketing, CRM management, social media, retargeting), types of data and categories of data subjects, obligations of each party, confidentiality of the agency's personnel, reasonable security measures, sub-processor regime (all the SaaS tools the agency uses on the client's behalf: email platform, CRM, ads manager, analytics tools), assistance for data subject rights, breach notification and return of the data to the client at the end of the contract. Without this addendum, the brand cannot lawfully engage the agency to process its personal data, and the agency itself breaches art. 28 GDPR.

Q: What happens to the data when the relationship between the agency and the brand ends?

Art. 28(3)(g) GDPR requires the processor to return to the controller the personal data processed on its behalf, or to allow its full export, and to proceed with secure destruction only afterwards. Applied to the marketing agency, this means that when closing the relationship with the brand-client, the agency must deliver to the brand all the data in a usable format (CSV, native platform export, accessible database) before deleting any residual copy retained in its systems. This includes: the complete subscriber list with all fields, the history of campaigns and results, the content of the customised CRM, and the templates and configurations that contain client data. An agency that merely deletes without delivering breaches art. 28(3)(g) and leaves the brand without operational continuity. The professional way to do it is to document the handover with a closing record listing what was delivered and the date of subsequent deletion.

A marketing agency is, by the very nature of its work, a critical node in the flow of its brand-clients' personal data. It manages subscriber lists, sends emails on behalf of brands, configures pixels and conversions, segments CRMs, runs campaigns on Meta, Google, TikTok and LinkedIn, optimises retargeting and, increasingly, operates synthetic audiences created with artificial intelligence. All that activity consists of processing personal data on behalf of a third party, which places the agency in the role of data processor under art. 28 GDPR.

This guide explains how a Spanish marketing agency regulates its relationship with brand-clients under the GDPR (Regulation EU 2016/679), the LOPDGDD (Organic Law 3/2018) and the LSSICE (Law 34/2002): what contractual document is needed, how to manage sub-processors, where the boundary lies between processor and independent controller, and what to do when closing the relationship.

The allocation of roles in the agency-brand chain

When a brand engages an agency to manage its commercial communications or its digital campaigns, two planes of personal data processing coexist with different roles:

Data of the brand's end customers (subscribers to its newsletter, buyers in its store, users of its website, leads from its campaigns): the brand is the controller of the processing; the agency is the processor that executes what the brand instructs.
The agency's own data (its portfolio of brand-clients, its commercial contacts, its staff, its prospects): the agency is the controller of the processing.

The professional agency reflects this duality in two distinct documents: its public privacy policy on the website, which covers the data it collects itself (commercial contact forms, the agency's own newsletter, job candidates), and an art. 28 GDPR data protection addendum signed with each brand-client to cover the professional services contracted.

The art. 28 GDPR addendum: the core piece of the engagement

Art. 28(3) GDPR requires the controller-processor relationship to be governed by a contract or other binding legal act with a minimum content. Applied to a marketing agency:

Clause	What it must state in a marketing agency
Subject matter and duration	Specific services contracted (email marketing management, paid campaigns, social media, SEO, CRM) for the term of the commercial contract.
Nature and purpose	Execution of the marketing actions on behalf of the brand, without use for its own distinct purposes.
Types of data and data subjects	Identifying data, contact data, browsing data, commercial interests and, where applicable, behavioural economic data. Data subjects: the brand's customers and subscribers.
Agency personnel	Confidentiality commitment through employment contract or specific clause, access to client data on the least-privilege principle.
Security measures	Encryption in transit, two-factor access control to the client's platforms, personnel onboarding and offboarding policy, backup of critical configurations.
Sub-processors	Named list or list by categories of all the SaaS tools the agency uses on the client's behalf: email platform, CRM, ads manager, analytics, generative AI.
International transfers	Identification of providers outside the EEA (Mailchimp, HubSpot, Google, Meta) and the basis for the transfer (Data Privacy Framework or standard contractual clauses).
Assistance for rights	The agency assists the brand-client when a request for access, erasure, rectification, objection or portability regarding its data arrives.
Breach notification	Specific deadline to notify the client of any breach (typically 24-48 hours), minimum information and collaboration procedure.
Return on termination	Delivery to the client of subscriber lists, CRM, histories and configurations in a structured format, before subsequent deletion.

Sub-processors: the agency's technology chain

A marketing agency typically works with a dozen SaaS tools: an email marketing platform (Mailchimp, Mailjet, Brevo, ActiveCampaign), a CRM (HubSpot, Salesforce, Pipedrive), ad managers (Meta Business Manager, Google Ads, TikTok Ads, LinkedIn Campaign Manager), analytics tools (Google Analytics, Matomo, Hotjar), automation (Zapier, Make), social media management (Hootsuite, Buffer, Metricool), AI content generation, SEO tools.

Each of these tools, when it processes the data of the brand's customers, is a sub-processor within the meaning of art. 28(2) GDPR. The practical obligations for the agency:

Keep an up-to-date list of the sub-processors used on behalf of each brand-client.
Sign with each sub-processor the standard DPA they offer (all professional platforms have one).
Pass on to the brand-client the list and, where applicable, obtain its authorisation to add new sub-processors.
Verify international transfers: the vast majority of these platforms are US-based and operate under the Data Privacy Framework or with standard contractual clauses.
Document the replacement of sub-processors when the agency changes platform, ensuring export and deletion.

The boundary with the independent controller role

The processor role has clear limits. There are three situations in which the agency simultaneously becomes an independent controller over data it also manages as a processor:

Cross-referencing data between clients: if the agency cross-references the lists or behaviours of several brand-clients to build its own sector benchmarks, it takes on its own purpose over that data and becomes a controller. It is only lawful if the data is aggregated or anonymised, or if the agency obtains an autonomous legal basis.
Training its own models: using brand-client data to train the agency's own scoring, recommendation or generative AI models is an own purpose that is not covered by the processor role.
Cross-selling prospecting: contacting the end customers of one brand to offer them the services of another brand (including the agency itself) does not fall within the processor role and requires an autonomous legal basis regarding the end data subject.

The clean professional practice is to reflect contractually which processing operations are pure processor activities and, if the agency wants to obtain some cross-cutting analytical value, to regulate it expressly with the client's explicit authorisation or by working with anonymised data.

"In a marketing agency, the art. 28 addendum is not paperwork: it is the piece that makes it possible to contract lawfully with serious brands. Those that do not offer it lose the clients who do know about data protection, and those that offer it badly lose the trust of the first client who reads it carefully."

Mario P. Talamillo · Managing Partner, Certix®

Breaches: the agency as the weak point

Agencies are a frequent target of attacks because they concentrate access to multiple accounts on critical platforms (email, ads, CRM) of several clients at once. A compromise of an account manager's account can translate into a breach affecting several brand-clients at the same time. Good practices:

Mandatory two-factor authentication on all the client's platforms.
Professional password management with a shared team vault, not passwords in spreadsheets or on sticky notes.
Least-privilege principle: each technician only accesses the clients they manage, not all of them.
Immediate offboarding protocol: when an employee leaves the agency, all their accesses are revoked that same day.
Detection and response: monitoring of suspicious access on the critical platforms and a procedure to notify the brand-client within 24-48 hours in the event of an incident.

Closing the relationship: the orderly handover that sets professionals apart

The closing of the contract is where art. 28(3)(g) GDPR is put to the test. A reasonable procedure:

Complete inventory of what the agency managed: subscriber lists, campaign histories, platform configurations, CRM content, audiences saved in ads.
Export in a usable format and delivery to the client: CSV of the lists, native CRM export, download of the history from email and ads platforms.
Transfer of ownership of the accounts and accesses to the client or the new provider: email domain, analytics properties, Meta business manager, Google Ads MCC.
Closing record signed to document what is delivered, on what date and to which person.
Confirmed deletion of the data processed as a processor in the agency's systems, with written evidence.
Residual retention only of what the agency's own accounting and tax rules require regarding its billing (not regarding the end customer's personal data).

Minimum checklist for the professional agency

Art. 28 GDPR addendum signed and archived with each brand-client.
Up-to-date list of the sub-processors used per client, with a DPA signed with each one.
Analysis of international transfers per client and per platform.
Operational security policy with two-factor authentication, password manager and least privilege.
Breach procedure with a client notification deadline of 24-48 hours.
Personnel onboarding and offboarding procedure with immediate revocation of accesses.
Standardised closing record with documented delivery and confirmed deletion.
Public privacy policy of the agency, separate from the content of the DPA with clients.

Frequently asked questions

Is a marketing agency a controller or a processor with respect to the data of its clients' end customers?

The general rule is processor (art. 28 GDPR): the agency processes the data on behalf of the brand-client, which is the controller. The agency remains the controller of its own data (commercial contacts, staff, suppliers). This duality must be regulated with an art. 28 GDPR addendum for each brand-client.

What must a marketing agency sign with its brand-client when starting the engagement?

In addition to the services contract, an art. 28(3) GDPR addendum with: subject matter, duration, nature, types of data, obligations, confidentiality, security measures, sub-processors, international transfers, assistance for rights, breach notification and return on closing. Without this addendum, the brand cannot lawfully engage the agency to process its data.

Can the agency use the data to improve its own services or train models?

No, unless expressly authorised by the brand and with an adequate legal basis. The processor role prohibits uses for its own purposes: no cross-referencing of data between clients for benchmarks, no training of its own AI models, no reuse of contacts for other clients and no extraction from the CRM for its own databases. What is legitimate is to work with anonymised data or to agree it expressly.

What happens to the data when the relationship between the agency and the brand ends?

Art. 28(3)(g) GDPR requires returning the data to the client before destroying it. Delivery of subscriber lists, CRM, histories and configurations in a usable format, transfer of accounts and accesses to the client or the new provider, a closing record and confirmed deletion in the agency's systems.

This content is for informational purposes only and does not constitute legal advice. The application of regulations to each specific case requires individual analysis. Spanish regional sectoral regulations may extend or modify deadlines and requirements.

Does your agency sign the art. 28 GDPR addendum with every brand-client?

At Certix we assign you an expert in compliance for the marketing sector. No sales intermediaries, no generic templates.

Speak to a specialist

Marketing agencies as data processors: contracts and responsibilities with their clients