DPA (data processing agreement)
Also called data processing agreement, data processing addendum.
The contract the GDPR requires between a data controller and a processor that handles personal data for it.
Last updated
What it is.
GDPR Article 28(3) says processing by a processor must be governed by a contract that sets out the subject matter and duration of processing, its nature and purpose, the types of personal data and categories of people, and the controller's rights and obligations.
It must also commit the processor to act only on documented instructions, keep staff bound by confidentiality, apply appropriate security, use sub-processors only with authorisation, help with data subject requests and breach duties, delete or return data at the end, and allow audits.
Why it matters
Without a DPA, a controller that shares personal data with a vendor is breaking the GDPR, even if the vendor is secure. For software companies selling to EU businesses, a ready DPA and sub-processor list is a normal part of closing a deal.
In a product build
If the product being built will process customer data for EU businesses, the DPA's promises, such as deletion on request and audit logs, have to exist as real features in the build.
Common mistakes.
- 01
Signing a DPA that promises things the product cannot do, such as deleting data from backups on demand.
- 02
Not updating the sub-processor list when the stack changes.
- 03
Mixing up a DPA (the contract) with a Data Protection Authority, the regulator. They share the acronym.
Read the official text.
Primary sources this definition is based on.
- Regulation (EU) 2016/679, the GDPR (Official Journal)checked 2026-10-25
Related terms.
- Data processor (GDPR)Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions.
- Data controller (GDPR)Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others.
- DPIA (data protection impact assessment)An assessment the GDPR requires before processing personal data in ways likely to put people's rights at high risk.
- BAA (business associate agreement)The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI.
Guides and pages
Browse the full glossary or read answers to common questions.
