Data processing agreement (DPA)

A data processing agreement (DPA) is the contract GDPR Article 28 requires between a controller and a processor, setting out how the processor handles personal data for the controller.

Part of the Learn hub and the customer data glossary.

What it means in practice

Article 28(3) says processing by a processor must be governed by a contract or other legal act that binds the processor and sets out the subject matter and duration, the nature and purpose of processing, the type of personal data, the categories of data subjects and the controller's obligations and rights. The contract must require the processor to: act only on documented instructions; ensure that authorised people are bound by confidentiality; take all measures required under Article 32 (security); respect the conditions for engaging another processor; assist the controller with data-subject requests and with obligations under Articles 32 to 36; at the controller's choice delete or return all personal data at the end of the services; and make available all information needed to show compliance, including for audits 1. Sub-processors need prior specific or general written authorisation, and the same obligations must pass down to them (Article 28(2) and (4)).

A customer data platform vendor is usually a processor, as is each destination that handles data on your behalf. Some destinations, such as advertising platforms, may act as separate controllers, so check each role. A self-hosted deployment may involve no processor if the vendor never touches the data, but remote support access can change that.

Financial entities also face DORA's contractual requirements for ICT services (Article 30), so a DPA is necessary but not sufficient.

Example (bank): a bank signs a DPA with its platform vendor that fixes permitted purposes, lists sub-processors, sets a deletion-and-return period at exit and gives audit rights.

Related terms

• Business associate agreement: the HIPAA counterpart.
• Register of information: DORA's record of such contracts.
• Destination: each recipient needs a role.
• Data residency: sub-processor locations matter.
• Purpose limitation: the DPA fixes the processor's purposes.

Where it matters

• Vendor lock-in in martech: nine clauses to check: contract and architecture checks.
• GDPR international transfers after Latombe: US-hosted marketing SaaS.

Back to the customer data glossary or the Learn hub.