Glossary
Data processing agreement (DPA)
Short answer
A data processing agreement (DPA) is a contract between a controller and a processor that governs how the processor handles personal data on the controller's behalf. Under GDPR Article 28 it must set the subject matter, duration, purpose, data types, security, sub-processor conditions and deletion or return of data.
By Pactinel editorial teamReviewed on October 22, 2026
Whenever a vendor processes personal data for a customer, such as a payroll, CRM or hosting service, a DPA is needed in many jurisdictions. It is often a standalone document attached to the main agreement.
What Article 28 requires
According to GDPR Article 28, the contract must bind the processor to, among other things:
- act only on the controller's documented instructions;
- keep personnel under confidentiality;
- apply appropriate security measures;
- follow the conditions for engaging subprocessors;
- assist with data subject requests and security obligations;
- delete or return data when the services end;
- allow audits and provide proof of compliance.
Example review point
A vendor's DPA says it may engage subprocessors with notice but gives the customer no right to object. Article 28(2) requires that, under a general authorization, the controller can object to changes, so this term needs negotiation.
Other regimes
Other countries have comparable rules, for example Turkey's data protection law (KVKK) and the UK GDPR. Cross-border transfers need an additional mechanism.
Check the order of precedence if the DPA and main agreement conflict. This is general information, not legal advice.