Glossary · Compliance concepts
What is Data Processing Agreement?
Also known as: DPA, Data Processing Addendum, Article 28 agreement
A Data Processing Agreement (DPA) is a contract between a data controller and a data processor that governs how the processor may handle personal data on the controller's behalf. Required by GDPR Article 28 and echoed in laws like India's DPDP Act, it sets the scope, purpose, security measures, sub-processing rules, and data-return/deletion obligations.
Key takeaways
- Mandated by GDPR Article 28 whenever a processor handles personal data for a controller.
- Defines processing scope and purpose, security measures, and confidentiality duties.
- Governs sub-processors, international transfers, breach assistance, and data return/deletion.
- Similar obligations appear in other regimes, including India's DPDP Act.
- A signed DPA is a baseline expectation in vendor due diligence and procurement.
What must a DPA include?
A GDPR-compliant DPA sets out the subject matter and duration of processing, the nature and purpose, the types of personal data and categories of data subjects, and the obligations of both parties. It requires the processor to implement appropriate security measures, assist with data-subject requests and breach notification, and delete or return data at the end of the engagement. It complements the broader duties of GDPR.
For onward transfers, the DPA typically incorporates safeguards such as Standard Contractual Clauses, and requires the controller's authorization before engaging sub-processors.
Frequently asked questions
- When do I need a DPA?
- Whenever you engage a vendor (processor) to handle personal data on your behalf. Under GDPR Article 28, the relationship must be governed by a DPA or equivalent binding contract.
- Is a DPA the same as a privacy policy?
- No. A privacy policy tells individuals how you use their data. A DPA is a contract between a controller and a processor governing how the processor may handle that data on the controller's behalf.