Data protection & AI

Data processing agreement (DPA)

Published Reviewed

Written and reviewed by Fredrik Surtell

A data processing agreement is the contract Article 28 of the GDPR requires between a controller and each processor. It must bind the processor to documented instructions, confidentiality, security measures, sub-processor rules, assistance with data subject rights and breaches, and deletion or return of data at the end of the engagement. Missing or hollow DPAs are among the most common findings in GDPR audits.

Läs definitionen på svenska: Personuppgiftsbiträdesavtal

Also known as: DPA · Biträdesavtal

Where this term does its work

This definition is general information, not legal advice. Always verify the current official source.