Understanding Data Processing Agreements (DPAs)

A DPA is legally required when a data controller engages a data processor. The controller is the entity that determines the purposes and means of the processing. The processor is the entity that processes personal data on the controller's behalf. This agreement codifies the processor's responsibilities, ensuring they act only on the controller's explicit instructions.

DPAs are essential when using third-party services such as SaaS platforms, HR software vendors, or cloud email providers. Without a valid DPA, both the controller and processor risk non-compliance with GDPR, which can lead to administrative fines up to €20 million or 4% of annual global turnover, whichever is higher, per Article 83(6).

Key DPA clauses serve specific outcomes. They require the processor to implement robust security measures to prevent data breaches. They also obligate the processor to assist the controller with data subject access requests. Finally, they ensure data is returned or deleted after the service ends, which prevents unauthorized data retention.