Security & governance
Data processing agreement (DPA)
A data processing agreement (DPA) is a contract between an organization that controls personal data and a supplier that processes it on the organization's behalf. It sets out what the supplier may do with the data, how it must protect it and what happens when the service ends. Under the GDPR, such a contract is mandatory whenever a controller uses a processor.
When is a data processing agreement required?
Whenever a controller hands personal data to a processor. That covers cloud storage, backup services, hosted applications, analytics providers and managed service providers with access to systems that hold personal data. The requirement comes from Article 28 of the GDPR, and other privacy laws contain similar obligations.
What must a data processing agreement contain?
The law lists the minimum content. A DPA that omits these points does not meet the requirement.
| Clause | What it covers |
|---|---|
| Subject matter and duration | What is processed, for what purpose, for how long |
| Documented instructions | The processor acts only on the controller's instructions |
| Confidentiality | Staff with access are bound to secrecy |
| Security measures | Technical and organizational protections |
| Sub-processors | Authorization, notice of changes, flow-down of obligations |
| Assistance | Help with data subject requests, breaches and impact assessments |
| Return or deletion | What happens to the data at the end of the contract |
| Audit | Information and inspections to demonstrate compliance |
What should be checked for a storage service?
For storage, a few clauses deserve particular attention. Location: where data and its replicas are held, and whether support staff in other countries can reach it. Sub-processors: which other companies are involved and how changes are notified. Deletion: how quickly data, including backups, is removed at exit, and what evidence is provided. And international transfers: whether data or access leaves the European Economic Area and under which safeguard, a question linked to extraterritorial data access.
Is a DPA needed for self-operated storage?
When an organization runs storage on infrastructure it operates, no third party is processing the stored data, so there is no processor to contract with for it. A DPA may still be relevant for the edges of the arrangement: remote support sessions, telemetry sent to the vendor or a managed service partner. Mapping which parties can actually reach personal data shows where a DPA is required and where it is not.
Frequently asked questions
Who provides the data processing agreement?
Either party can. Large providers usually offer a standard DPA. The controller is responsible for checking that it meets the legal requirements.
Is a DPA the same as standard contractual clauses?
No. A DPA governs processing by a processor. Standard contractual clauses are a safeguard for transferring data outside the European Economic Area. Both may be needed.
Does a DPA transfer liability to the processor?
No. The controller remains accountable. The DPA allocates obligations between the parties.
Related terms
- GDPR: the regulation that requires the agreement.
- Data controller vs. data processor: the roles the agreement binds.
- Third-party risk management (TPRM): assessing the processor before signing.
- Extraterritorial data access: a risk the agreement cannot remove.
- Data localization: location terms the agreement should state.