Governance, Law & Compliance
Data processing agreement
DPA
A contract describing how personal data will be processed and protected.
Example
A contract defines how a vendor may process personal data on the company's behalf.
Why it matters
It clarifies responsibilities between organizations when one handles personal information for another.
You'll hear it
“Does the contract cover what the provider actually does with our data?”
Can you control it?
Sometimes
Sometimes. An organization can define or influence a data processing agreement through its policies, processes, contracts, and product choices. Individual users may have fewer controls.
Common questions
- Does signing it make every use of data lawful?
- No. The underlying collection and use still need to meet applicable requirements.
- Should it address other providers involved in the service?
- Check the applicable requirements for subcontractors and whether the agreement covers their role.
- What happens to data when the service ends?
- The agreement should address return or deletion, subject to applicable retention requirements.