📄Data Processing Agreement

NEW

Also known as: DPA

A contract defining obligations and safeguards for processing personal data between controller and processor.

DESCRIPTION

A Data Processing Agreement (DPA) sets terms under GDPR Article 28 for processors handling personal data on behalf of controllers. It specifies processing scope, duration, purpose, confidentiality, security, sub-processing, and data subject rights assistance. DPAs require documented instructions and breach notification duties. Standardized addenda and SCCs are often used for international transfers. Robust DPAs reduce legal risk and clarify accountability.

ALTERNATIVE DEFINITIONS

European Union

Processing by a processor shall be governed by a contract that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.

Defines the mandatory content of contracts between controllers and processors under GDPR.

Source

UK ICO

You must have a written contract in place whenever you use a processor, and it must set out the processor’s obligations and your rights.

Clarifies legal obligation and the need for written terms.

Source

IAPP

A data processing agreement is a legally binding document between a controller and a processor that outlines how personal data will be processed and protected.

Highlights legal binding nature and protection obligations.

Source

RELATED TERMS

GDPR Controller Microprocessor Article 28 Data Protection Impact Assessment Records of Processing Activities Sub-processor Data Protection Addendum Privacy Policy

COMPETING TERMS

Joint Controller Agreement Standard Contractual Clauses

KNOWLEDGE AREAS

Data Privacy & Compliance Data Governance Data Management

TARGET AUDIENCE

Data Privacy Officer Chief Information Security Officer IT Auditor Chief Data Officer Data Governance Manager IT Manager

EXTERNAL SOURCES

• Wikipedia - General Data Protection Regulation
• European Union - Official GDPR legal text
• European Data Protection Board - Guidelines and recommendations
• UK ICO - GDPR contracts guidance

TOP QUESTIONS

What is a Data Processing Agreement (DPA)?

It’s a GDPR-required contract between controller and processor detailing processing scope, safeguards, and obligations.

Category: Definition

Why is a DPA necessary?

It ensures legal compliance, clarifies responsibilities, and mandates security and breach notifications.

Category: Relevancy

What must a DPA include?

Subject matter, duration, purpose, data types, data subjects, security measures, sub-processing rules, and rights obligations.

Category: Requirements

How do DPAs address sub-processors?

They require prior authorization, equivalent obligations, and transparency about sub-processor lists and changes.

Category: Management

What mistakes occur with DPAs?

Vague instructions, missing security specifics, and no breach notification timelines create compliance gaps.

Category: Mistakes

What are DPA risks?

Insufficient safeguards may lead to enforcement actions, breach liabilities, and reputational damage.

Category: Risks

What competes with DPAs?

Joint Controller Agreements and SCCs address related governance and transfer needs, not the same scope.

Category: Alternatives

How to implement DPAs at scale?

Use standard templates, track processors and sub-processors, and automate reviews and updates.

Category: HowTo

Where to learn about DPAs?

Read GDPR Article 28, EDPB guidance, and ICO and IAPP resources.

Category: Learning