DPA (Data Processing Agreement) is a mandatory contract under GDPR Article 28 between a data controller (the organization collecting data) and a processor (a vendor handling that data on the controller's behalf).
The DPA specifies:
- What personal data the processor may access
- How the processor must secure, protect, and restrict access to that data
- Sub-processor policies and approval requirements
- The controller's audit and inspection rights
- Breach notification timelines and procedures
- Data deletion or return obligations at contract end
Most EU-facing vendors dedicate significant procurement cycles to DPA negotiation because each controller often requires variations on standard terms to match their data handling policies.