Data Processing Agreement (DPA)

A Data Processing Agreement (DPA) describes the obligations of an organization processing personal data on another organization's behalf. Under the EU GDPR, Article 28 requires a contract or other binding legal act when a controller uses a processor. It addresses the processing purpose, duration, data categories, instructions, security measures, subprocessors, assistance, and what happens to data at the end of the relationship.

A website owner may encounter a DPA when purchasing CRM software, email marketing, hosting, or support tools that handle identifiable customer information. The document should match the actual roles and processing activities, not simply copy a generic legal template. A supplier can sometimes act as a controller for one activity and a processor for another.

A DPA is not the same as a privacy notice shown to website visitors. It also does not automatically resolve questions about international transfers, the legal basis for collection, or state-specific US requirements. Those questions need separate review.

For a small service business, a useful first step is to map which vendors receive lead forms, appointment details, or contact records and determine which agreements genuinely apply.