Data Processing Agreement (DPA)

A Data Processing Agreement, commonly called a DPA, is a contract that governs how a processor handles personal data on behalf of a controller.

Under the GDPR, Article 28 requires controllers and processors to establish specific contractual terms when personal data is processed on the controller's behalf.

A DPA typically addresses the purpose and duration of processing, types of personal data, security requirements, confidentiality, subprocessors, assistance with data subject rights, deletion or return of data, and audit obligations.

DPAs help organizations document responsibilities and ensure that vendors processing personal information are subject to appropriate privacy requirements.