What is Data Processing Agreement (DPA)?

Last updated: October 21, 2026

A Data Processing Agreement (DPA) is the written contract required by GDPR Article 28(3) between a controller and a processor. It sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and data subjects, and the processor's obligations to act only on documented instructions and protect the data.

Related toolkit: GDPR Compliance Pack for Small Business ($79)

Whenever a controller uses a vendor to process personal data on its behalf, Article 28(3) requires that processing to be governed by a written contract — the DPA is not optional. The contract must impose specific duties on the processor: confidentiality, appropriate security, assistance with data-subject rights and breach notification, restrictions on sub-processors, and deletion or return of data at the end of the engagement.

This contract is also called a data protection agreement. The European Data Protection Board (EDPB) uses both names for it in its guidelines on controllers and processors. The GDPR's own text uses neither name: Article 28(3) calls it a "contract or other legal act" that binds the processor to the controller. Article 28(9) requires it to be "in writing, including in electronic form," and the EDPB says it "should not merely restate the provisions of the GDPR" but should state concretely how each requirement will be met.

For example, a clinic using a cloud booking system needs a DPA committing that vendor to handle patient contact data only as instructed and to help with access requests and breaches. Note the acronym clash: in the UK, "DPA" also commonly means the Data Protection Act 2018, so spell it out in contracts. The HIPAA equivalent of this controller–processor contract is the Business Associate Agreement.

The ComplianceDocs GDPR pack does not include a DPA contract. Its Processor and Vendor Management Policy covers every vendor that processes personal data for you, and the policy requires each new or renewed DPA to be checked against the policy's Article 28(3) clause checklist before signing. The agreement evidences and allocates responsibility — but real protection comes from choosing competent processors and confirming they actually meet the commitments.

Related terms: Data Controller vs Data Processor · Vendor Risk Management · Business Associate Agreement (BAA) · Records of Processing Activities (RoPA)

Frequently asked questions

When is a Data Processing Agreement required?

Whenever a controller engages a processor to handle personal data on its behalf. Article 28(3) requires the processing to be governed by a written contract, so a DPA must cover every processor that handles personal data for you — for example cloud, payroll, email or CRM vendors.

What must a GDPR data processing agreement include?

Article 28(3) requires the contract to set out the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the controller's obligations and rights. It must also require the processor to: (a) process the data only on the controller's documented instructions, including for any transfer to a third country or international organization; (b) ensure that everyone authorized to process the data has committed to confidentiality or is under a statutory duty of confidentiality; (c) take all the security measures Article 32 requires; (d) engage sub-processors only with the controller's prior written authorization and impose the same data protection obligations on them; (e) help the controller, as far as possible, answer requests from people exercising their GDPR rights; (f) help the controller meet its duties under Articles 32 to 36 (security, breach notification, data protection impact assessments and prior consultation); (g) delete or return all the personal data at the end of the services, as the controller chooses, and delete existing copies unless EU or member state law requires keeping them; and (h) give the controller the information needed to demonstrate compliance and allow audits, including inspections. The processor must also tell the controller immediately if it believes an instruction infringes data protection law.

How is a DPA different from a Business Associate Agreement?

Both bind a service provider to protect data, but a DPA is a GDPR Article 28 controller–processor contract for personal data, while a Business Associate Agreement is the HIPAA contract governing protected health information in the US.

Does "DPA" always mean Data Processing Agreement?

No — in the UK it often means the Data Protection Act 2018, the national law that sits alongside the UK GDPR. Spell the term out in contracts to avoid confusion.

Is there an official standard DPA under the GDPR?

Yes. The European Commission adopted standard contractual clauses for controller–processor contracts in Implementing Decision (EU) 2021/915, which states that they "fulfil the requirements for contracts between controllers and processors in Article 28(3) and (4)" of the GDPR. Using them is optional: the EDPB says there is no obligation to use them instead of an individually negotiated contract, and either route can work as long as it meets the Article 28(3) requirements. If you accept a vendor's own DPA, the EDPB says a small controller's weaker bargaining position does not justify accepting terms that fall short of data protection law, so check it against the Article 28(3) list. These clauses are not the same as the standard contractual clauses used for transfers to third countries under Article 46.

Toolkits that cover Data Processing Agreement (DPA)

Learn more in our GDPR guide, explore the editable policy templates, or browse the full compliance glossary.

← Back to the compliance glossary