GDPR Glossary Also known as: DPA, Article 28 contract
The mandatory written contract that must be in place between a controller and a processor.
A Data Processing Agreement (DPA) is the Article 28 contract that governs a controller–processor relationship, setting out the subject matter, duration, purpose, obligations and the processor's duties.
Without one, sharing personal data with a processor is itself a compliance failure.
In the Regulation
Related terms
Data processorA third party that processes personal data on behalf of, and under the instructions of, a data controller.Data controllerThe organisation or person that decides why and how personal data is processed — and carries primary responsibility under the GDPR.Standard Contractual ClausesPre-approved contract terms that provide a safeguard for transferring personal data outside the EEA.
Need this applied to your business?
Our data-protection lawyers turn GDPR terms into a working plan.