dPAS

A data processing agreement (DPA) is a contract between a data controller and a data processor that governs the processing of personal data on behalf of the controller, in accordance with data protection law such as the European Union’s General Data Protection Regulation (GDPR) and, where applicable, national implementations. A DPA sets out the roles and responsibilities of each party, the scope of processing, and the technical and organizational measures required to protect the data.

Core elements typically covered in a DPA include the subject matter, purpose, duration, nature of processing, categories of data subjects, and types of personal data. It specifies that the processor must process data only on documented instructions from the controller, maintain confidentiality, implement appropriate security measures, and assist the controller with data subject requests and regulatory compliance. The agreement addresses breach notification requirements, audit rights, and the processor’s obligation to obtain authorization for subprocessors and impose equivalent obligations on them. It also covers data return or destruction at the end of processing and provisions for cross-border transfers, often detailing transfer safeguards such as standard contractual clauses when data moves outside the EEA.

DPAs are essential whenever a controller uses a processor such as a cloud provider, SaaS vendor, or outsourced service that handles personal data. They accompany contractual terms or service agreements and are legally binding. Under GDPR, the controller retains primary responsibility for compliance, while the processor bears direct obligations under the DPA to protect data and support the controller’s legal duties.