Glossary term
Data Processing Agreement (DPA)
Subject: Technology, Cyber and Data, Data Protection and Privacy
Also known as: DPA, Processor agreement, Data processing addendum
A data processing agreement is the written contract a controller must have with any processor handling personal data for it, setting out what the processor may do, for how long, and under which safeguards.
Explanation
Data protection laws such as the GDPR require this contract before a supplier touches personal data. It normally states the subject matter, duration, nature and purpose of the processing, the types of data and the categories of people involved. The processor must act only on documented instructions, keep staff bound to confidentiality, apply security measures, and use sub-processors only with approval and on the same terms. It must also help the controller with rights requests and breach handling, and delete or return the data at the end. Vendors often supply their own standard form, which the buyer's legal team then negotiates. In some places DPA also means a data protection authority, so context matters. Auditors ask to see it for every supplier that touches personal data.
Example
A software company engages an external help-desk provider that will see customer names and emails. Before onboarding, legal signs a data processing agreement. It limits the provider to handling tickets, requires breach alerts within 24 hours, forbids sub-contracting without approval, and obliges deletion of all records ninety days after the contract ends.
Not to be confused with
- Service level agreement
- Covers performance and availability. A data processing agreement covers how personal data may be used and protected.