Data processing agreement (DPA)
A data processing agreement (DPA) is the contract GDPR requires when a processor handles personal data on a controller’s behalf. It fixes the scope and duration of processing, security measures, confidentiality, subprocessor rules, breach notification, and what happens to the data when the engagement ends.
The contract GDPR requires between a data controller and a data processor, setting out the scope and duration of processing, security measures, confidentiality, subprocessor conditions, breach notification, and end-of-engagement data handling.
Data processing agreement (DPA).
Glossary · DPAThe processor’s rulebook
GDPR splits the world into controllers, who decide why and how personal data is processed, and processors, who do it for them. A SaaS product processing customer end-user data is almost always a processor — which means every serious European or privacy-conscious customer will put a DPA in front of you before go-live. The agreement obligates you to process only on documented instructions, keep the data confidential and secure, help the controller answer data-subject requests, and disclose the subprocessors you rely on.
DPA versus BAA
The two get conflated because both are “the privacy contract.” A BAA is HIPAA-specific: US health data, covered entities, business associates. A DPA implements GDPR: personal data of people in Europe, any industry, controller-processor mechanics, and typically an annex of technical and organizational measures plus international-transfer terms. Plenty of health-tech companies sign both — for different data, under different laws.
Signing it versus living it
Your counsel owns the terms; your security program owns their truth. The measures annex you attach — encryption, access control, testing, incident response — becomes a commitment customers and auditors check against reality, which is why DPAs and GDPR programs get built together rather than sequentially.
Glossary
A DPA your program can back up
Agency builds the technical and organizational measures your agreements promise — and keeps the evidence current. 500+ programs delivered. 4.9/5 on G2.
Platform Products
Agency AIEnd-to-end cybersecurity and compliance, across the stack you already use.GRC IntegrationsEngineer-operated GRC platform integrationAuditsuisse AIAI-powered evidence collection and analysis for IT audits.Find your auditor
Auditnex makes buying audits simpler and more transparent.
Agency implements the controls, collects the evidence, and manages your auditor relationship on top of the GRC tools you already use.
Explore AuditnexCommon GRC Questions
GRC Platform & Virtual CISO FAQ
The long-form FAQ on how managed GRC and virtual CISO coverage work together.
Read the FAQMore from Agency
See it on the home pageBuild a Security & Compliance Team Led by Your Own Virtual CISO
Forward-Deployed Engineers + AI that lower costs, increase velocity, and raise the bar — from policy to audit to remediation. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust.