A DPA (Data Processing Agreement) is a contract between a data controller, the organisation that decides why and how personal data is used, and a processor, a vendor that handles that data on its behalf. It defines what the processor may do with the data and what safeguards it must apply.
Why it matters
Privacy laws such as the GDPR require a written agreement whenever a processor handles personal data for a controller. Customers of SaaS tools, email platforms, analytics services and cloud hosts therefore often sign a DPA with the vendor. Typical clauses cover permitted purposes, security measures, sub-processors, breach notification, assistance with data subject requests and deletion or return of data at the end of the contract. Requirements vary by country.
Example
A company sends customer emails through a newsletter platform. The platform's DPA states that it processes the addresses only on the company's instructions, lists its sub-processors, requires notice of a breach within a set number of hours and commits to deleting the list after termination.
Common mistakes
- Assuming a vendor's terms of service replace a DPA.
- Not reviewing the list of sub-processors or the data transfer mechanism.
- Confusing it with a privacy policy, which is a public notice to individuals.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.