Credbase
Start free
Glossary · Compliance and data protection

Data processing agreement (DPA)

A data processing agreement (DPA) is the contract required under GDPR whenever a data controller uses a data processor, setting out the scope, purpose, security and sub-processing rules for the personal data involved.

Full definition

Data processing agreement (DPA) is defined as: A data processing agreement (DPA) is the contract required under GDPR whenever a data controller uses a data processor, setting out the scope, purpose, security and sub-processing rules for the personal data involved.

GDPR Article 28 lists the specific clauses a DPA must contain, including the subject matter and duration of processing, the categories of data, the confidentiality obligations of staff, security measures, sub-processor arrangements and assistance with data-subject rights.

Most SaaS suppliers publish a standard DPA. Reading and signing it is a required part of onboarding any supplier that will touch personal data, and the signed version should live in your evidence pack.

Also known as

DPA

Related terms

Read more on Credbase Learn

Questions and answers

Put it into practice

Manage data processing agreement (dpa) in Credbase.

Credbase brings every supplier document into one workspace, tracks expiry dates for you and turns the whole set into a shareable evidence pack. Free to start, no card required.

Create a free profile Back to glossary