DPA

DPA is an acronym with several meanings in different domains. Most commonly, it denotes Data Processing Agreement, a contract governing the handling of personal data by processors on behalf of a controller. It may also refer to a Deferred Prosecution Agreement in criminal law, or to a Data Protection Authority, a privacy regulator. Context determines meaning.

Data Processing Agreement: A contract between a data controller and a data processor that governs how personal data is processed on the controller's behalf. It defines the processing purpose, duration, data categories, and the roles of each party. It requires the processor to follow instructions, implement security measures, manage subprocessors, assist with data subject rights, report breaches, and delete or return data at termination. It may address cross-border transfers, retention, audits, and remedies for non-compliance.

Legal framework: In GDPR and UK GDPR, a DPA is mandatory when processing personal data on behalf of a controller. The agreement clarifies responsibilities, imposes security obligations, and enables audits or assessments. It helps allocate liability and ensure data subject rights are upheld. Non-compliance can result in penalties, fines, or contractual remedies, and data controllers retain ultimate accountability for lawful processing.

Deferred Prosecution Agreement: In some jurisdictions, a DPA is a settlement in which prosecutors defer criminal charges against a company in exchange for compliance with specified terms. Terms may include financial penalties, enhanced compliance programs, independent monitoring, and ongoing reporting. If the company adheres to conditions for the set period, charges may be dropped; failure to comply can lead to prosecution.

Data Protection Authority: A regulatory body responsible for enforcing data protection laws, handling complaints, and issuing guidance. DPAs at the regulator level vary by jurisdiction; powers typically include investigations, orders, fines, and oversight of controllers and processors to ensure compliance with data protection rules.