Data processing agreement

A data processing agreement (DPA) is the contract a controller must sign with a processor under GDPR Article 28, saying what personal data the processor handles, why, and under which safeguards.

Whenever a company uses a vendor to process personal data on its behalf, such as a cloud host, an email service or a clean room operator, Article 28(3) requires a binding contract. The contract must describe the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of people concerned (GDPR, Article 28, EUR-Lex).

Article 28(3) also lists terms the contract must contain. The processor acts only on documented instructions, including on international transfers. Its staff are bound by confidentiality. It applies the security measures of Article 32 and uses sub-processors only with the controller's authorisation and on the same terms. It helps the controller answer requests from individuals and meet its security and breach duties. It deletes or returns the data at the end, and it allows audits.

A DPA fits a processor relationship. Many ad tech vendors act as independent or joint controllers for some purposes, for example when they use bid data to improve their own models. Those relationships need different terms, such as a joint controller arrangement.

Example: A retailer hires a clean room vendor to match its loyalty data with a brand's data. The DPA limits the purpose to overlap and campaign measurement and forbids the vendor to use the data for its own products. It lists approved sub-processors and the EU hosting region, and requires deletion within 30 days after the contract ends.

Related terms: joint controller, SCC, legitimate interest, clean room, data residency.

Authoritative source: Regulation (EU) 2016/679 (GDPR), Article 28, EUR-Lex.