Data processing agreement (DPA)

The contract between a company and a vendor that processes personal data for it, setting out how that data is handled, secured, and returned or deleted.

The GDPR requires a written contract whenever one organisation processes personal data on behalf of another. The DPA covers what data is processed and why, security measures, subprocessors, international transfers, breach notification, and what happens to the data when the contract ends.

Many SaaS companies publish a standard DPA that customers accept with their terms, and link it to a published subprocessor list so the list can change without amending the contract. A template can be drafted from what's already on your trust center, but a lawyer should review it before it's sent or signed.

What a reviewer wants to see

• A DPA they can read before procurement starts
• Breach notification and deletion terms that match the rest of your answers
• A link to the subprocessor list it relies on