Contract between controller and processor defining data processing terms and GDPR compliance obligations.
A Data Processing Agreement (DPA) is a legally required contract between controllers and processors defining how personal data will be processed. GDPR Article 28 specifies required DPA contents—processing scope, security measures, sub-processor requirements, audit rights, and obligations upon termination. DPAs allocate responsibilities and ensure processors meet GDPR requirements. Without appropriate DPAs, both parties risk non-compliance.
Why It Matters
The DSC Perspective:
DPAs are legally required when using processors. Ensure your vendor contracts include GDPR-compliant DPAs. Review DPAs carefully—they define responsibilities when things go wrong.