What is a Data Processing Agreement (DPA)?

What Article 28 requires it to contain

The contract must describe the processing: its subject matter and duration, its nature and purpose, the types of personal data, the categories of people concerned, and the controller’s obligations and rights. It must then commit the processor to the terms Article 28(3) lists one by one.

• Instructions. The processor acts only on the controller’s documented instructions, including on transfers to third countries.
• Confidentiality. People authorised to process the data are bound by confidentiality.
• Security. The processor takes the measures Article 32 requires.
• Sub-processors. It uses them only with the controller’s authorisation, and passes on the same data protection terms.
• Assistance. It helps the controller answer requests from individuals and meet its duties under Articles 32 to 36.
• End of contract. It deletes or returns the data, as the controller chooses.
• Audits. It provides the information needed to show compliance and allows audits and inspections.

How DPAs work in practice

Most SaaS vendors offer a standard DPA, often as an addendum to their terms. Customers usually accept it for routine services and negotiate when the data is sensitive or the volume is large. The European Commission has also adopted standard contractual clauses for controller and processor contracts, which either side can use as the DPA.

International transfers are a separate question. If personal data leaves the European Economic Area, the DPA needs a transfer mechanism alongside it, such as the Commission’s standard contractual clauses for international transfers. The UK GDPR keeps the same Article 28 requirements.

What auditors and buyers check

A GDPR programme needs a DPA with every processor that handles personal data on your behalf, and your record of processing should show which processors are involved in each activity. Customer security questionnaires often ask for your DPA and your sub-processor list together.

In SOC 2 and ISO 27001 audits, DPAs appear as evidence for supplier management. ISO 27001 Annex A 5.20 covers security requirements in supplier agreements, and auditors check that contracts with key vendors include security and privacy terms and were signed before data was shared.

Related terms

Sub-processor

A third party that processes personal data on behalf of a processor. Under GDPR a processor needs the controller’s authorisation to use one and must tell it about changes.

Data Protection Impact Assessment (DPIA)

A GDPR-required assessment of processing likely to result in a high risk to individuals, recording the risks and the measures that reduce them before the processing starts.

Business Associate Agreement (BAA)

A HIPAA-required contract between a covered entity and any vendor that creates, receives, maintains or transmits protected health information on its behalf.