{"head":{"title":"What Is a DPA (Data Processing Agreement)? | OceanLab","description":"A DPA is the contract the GDPR requires between a controller and a processor of personal data. What Article 28 says it must contain and the usual mistakes.","canonical":"https://oceanlab.in/glossary/dpa"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"DPA","path":"/glossary/dpa"}],"slug":"dpa","term":"DPA (data processing agreement)","aka":["data processing agreement","data processing addendum"],"category":"Compliance","short":"The contract the GDPR requires between a data controller and a processor that handles personal data for it.","body":[["GDPR Article 28(3) says processing by a processor must be governed by a contract that sets out the subject matter and duration of processing, its nature and purpose, the types of personal data and categories of people, and the controller's rights and obligations."],["It must also commit the ",{"href":"/glossary/data-processor","text":"processor"}," to act only on documented instructions, keep staff bound by confidentiality, apply appropriate security, use sub-processors only with authorisation, help with ",{"href":"/glossary/data-subject-request","text":"data subject requests"}," and breach duties, delete or return data at the end, and allow audits."]],"why":["Without a DPA, a controller that shares personal data with a vendor is breaking the GDPR, even if the vendor is secure. For software companies selling to EU businesses, a ready DPA and sub-processor list is a normal part of closing a deal."],"example":["A European retailer wants to use a US analytics SaaS. Its procurement team will not sign until the vendor provides a DPA, a list of sub-processors with their locations, and the transfer mechanism used for data leaving the EU."],"inBuild":["If the product being built will process customer data for EU businesses, the DPA's promises, such as deletion on request and audit logs, have to exist as real features in the build."],"mistakes":[["Signing a DPA that promises things the product cannot do, such as deleting data from backups on demand."],["Not updating the sub-processor list when the stack changes."],["Mixing up a DPA (the contract) with a Data Protection Authority, the regulator. They share the acronym."]],"related":[{"href":"/glossary/data-processor","label":"Data processor (GDPR)","detail":"Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions."},{"href":"/glossary/data-controller","label":"Data controller (GDPR)","detail":"Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others."},{"href":"/glossary/dpia","label":"DPIA (data protection impact assessment)","detail":"An assessment the GDPR requires before processing personal data in ways likely to put people's rights at high risk."},{"href":"/glossary/baa","label":"BAA (business associate agreement)","detail":"The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI."}],"tools":[],"links":[{"href":"/compliance/gdpr","label":"GDPR guide","detail":"Who the GDPR applies to and what it asks of software."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."}],"sources":[{"title":"Regulation (EU) 2016/679, the GDPR (Official Journal)","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}