Draft
What is a DPA (data processing agreement)?
By The Citesheet team · Published
Short answer
A DPA (data processing agreement, also called a data processing addendum) is the contract that governs how a vendor processes personal data on a customer's behalf. Under the EU GDPR, Article 28 requires one whenever a processor handles personal data for a controller. It sets out what data is processed, for what purpose, the security measures, and the rules for subprocessors. It often travels with a security questionnaire during procurement.
A DPA (data processing agreement, or data processing addendum) is a contract between a company and a vendor that processes personal data for it. In GDPR terms, the company is the controller (it decides why and how data is processed) and the vendor is the processor.
What the law requires
Article 28 of the GDPR says processing by a processor "shall be governed by a contract or other legal act." It lists what that contract must cover, including:
- the subject matter, duration, nature and purpose of the processing, and the types of personal data
- that the processor acts only on the controller's documented instructions
- confidentiality of the people who process the data
- appropriate security measures
- the rules for using subprocessors
- deleting or returning the data at the end of the service
- helping the controller show compliance, including audits
DPAs and security reviews
For a software vendor, the DPA and the security questionnaire are two halves of the same review: the questionnaire describes your controls, and the DPA turns some of them into contractual promises. That is why questionnaire answers matter. If your answer says you encrypt backups and your DPA's security annex says so too, you are now contractually committed to it. Keep the two consistent, and don't claim in one what you can't stand behind in the other.