Data processing agreement (DPA): what the GDPR requires

What is a data processing agreement?

A data processing agreement is the contract between a controller and a processor that sets out how the processor may handle personal data on the controller’s behalf, as the GDPR requires.

A DPA (GDPR Article 28 requires one whenever a processor is used) is often signed as an addendum to the main service agreement.

Do I need a DPA?

If you process personal data of people in the EU or UK on behalf of a customer, almost certainly: you are a processor, and your customer, the controller, must have a DPA with you. If vendors process personal data for you, you need DPAs with them as well. Take legal advice on your situation; the requirement is clear, the details vary.

What goes in a DPA

  • The subject matter, duration, nature and purpose of the processing.
  • The types of personal data and the categories of people involved.
  • Processing only on the controller’s documented instructions.
  • Confidentiality, security measures and help with data subject requests.
  • Rules for subprocessors, audits, breach notification and the deletion or return of data at the end.

DPA vs BAA

Both are contracts that pass data protection duties to a vendor. A DPA comes from the GDPR and covers personal data of any kind. A BAA comes from HIPAA and covers protected health information. A US health-tech vendor with European customers may need both.

Keeping your side of the DPA

Signing a DPA commits you to the security measures it lists. Compliance as a Service for SMBs turns the GDPR into a checklist of controls, each with the evidence that satisfies it and a reminder before that evidence goes stale.

Last reviewed 2026-11-01.

Related terms

  • Subprocessor — A subprocessor is a third party that a data processor engages to process personal data on behalf of its customer, such as the cloud host or email service a software company uses to deliver its product.
  • Business associate agreement (BAA) — A business associate agreement is a contract HIPAA requires between a healthcare organisation and any vendor that creates, receives, stores or transmits protected health information on its behalf.
  • Protected health information (PHI) — Protected health information is individually identifiable health information held or transmitted by a HIPAA covered entity or its business associate: details about a person’s health, care or payment for care that can be linked to them.

All glossary terms →