DPA stands for data processing agreement, and under the GDPR it is not optional decoration on a vendor contract. Where one organization processes personal data on another's behalf, the regulation requires a contract containing a specific set of terms. Most small companies meet it as a link in a supplier's terms rather than a document they draft, which makes reading it properly the actual skill.
Who owes one to whom
The controller decides why and how personal data is processed. The processor does it on the controller's instructions. Any time a vendor handles personal data for you and does not decide the purpose themselves, you are the controller and they are the processor, and the contract is owed. That reaches further than people expect: hosting, email delivery, analytics, error tracking, support desks, payroll bureaux, backup providers and freelance contractors with access to a system all qualify.
The clauses the regulation names
Article 28(3) sets out what the contract must include: the subject matter, duration, nature and purpose of the processing, the types of data and categories of people; that the processor acts only on documented instructions, including about transfers; confidentiality commitments from the people doing the work; the security measures; the rules on engaging sub-processors; assistance with data subject requests; assistance with security, breach notification and impact assessments; deletion or return of the data at the end; and information and audit rights. A vendor document missing any of those is incomplete whatever it is titled.
What to read first in a vendor's standard DPA
Two clauses vary and matter. The sub-processor clause, because general authorization with notice is normal and the notice period and objection right are where the versions differ. And the deletion clause, because return or deletion at the end of the service is required, and what a vendor means by deletion in backups is the part that is usually vague. After those, check the transfer mechanism actually names the safeguard used rather than promising one will be selected later.
Transfers are part of the same document
Where the processing involves moving data outside the European Economic Area, the agreement has to carry a lawful transfer mechanism. For most vendors that is the European Commission's standard contractual clauses, incorporated by reference with the annexes filled in. An annex left blank is a common defect and it matters, because the annexes are where the actual processing, the security measures and the sub-processors are described. A signed set of clauses with empty annexes describes nothing.
Questions people ask about dpa GDPR
What does DPA stand for?
Data processing agreement. In European conversation it can also mean data protection authority, and occasionally the UK's Data Protection Act, so it is worth confirming which sense a document means.
Do we need one with every vendor?
With every vendor that processes personal data on your behalf. A supplier that never touches personal data does not need one, and a partner deciding their own purposes is a separate controller rather than a processor.
Is a clickthrough DPA valid?
It can be, if the terms are complete and you can produce the version you accepted and when. Keeping a dated copy is the part that usually fails, not the signing.
Does the US have an equivalent requirement?
California requires contractual terms with service providers and contractors covering purpose limitation and onward disclosure, so the shape is similar even though the clause list is not identical.