What is a data processing agreement (DPA)?

A Data Processing Agreement serves as a roadmap for how personal information is handled by third parties. It is not just a best practice but a legal requirement under frameworks like the EU's GDPR and the UK's version of the same law. Without a DPA, a company sharing user data with a cloud provider or marketing agency could face massive fines for non-compliance.

The document clearly defines the roles of the 'Controller' (who decides why data is collected) and the 'Processor' (who handles data on behalf of the controller). By signing this, the processor commits to providing sufficient guarantees regarding technical and organizational security measures.

In the European Union and UK, the GDPR mandates specific language in DPAs, including the processor's duty to assist in audits and breach notifications. In the United States, there is no single federal law, but state laws like the CCPA/CPRA require similar contractual protections for 'service providers' handling California residents' data.

In India, the Digital Personal Data Protection Act (DPDP) has introduced stricter requirements for data fiduciaries and processors. While the terminology varies, the global trend is moving toward mandatory written contracts that penalize the unauthorized sub-processing of data without the controller's prior written consent.

• EU/UK GDPR: Mandatory specific clauses under Article 28.
• USA (CCPA): Focuses on prohibiting the sale of personal data.
• India (DPDP): Emphasizes the duty of data fiduciaries to protect data.
• Standard Contractual Clauses (SCCs): Used for international data transfers.
• Liability: Often a major point of friction during negotiations.

One of the most critical aspects of a DPA is the control over sub-processors. A sub-processor is a third party hired by the processor to help perform their duties. Controllers must know where their data goes, so DPAs usually require processors to get approval before adding new sub-contractors.

Transparency is maintained through regular updates to the sub-processor list. If a controller objects to a new sub-processor for security reasons, the DPA should provide a mechanism for the controller to terminate the service without heavy penalties.

A DPA must detail the specific security standards the processor will implement, such as encryption, pseudonymization, and regular vulnerability testing. It is not enough to say security will be 'adequate'; the contract should reference specific certifications like ISO 27001 or SOC 2.

Furthermore, the right to audit is a standard requirement. The controller or an independent auditor should be allowed to inspect the processor's facilities or digital logs to ensure compliance with the agreed terms.

• Encryption of data at rest and in transit.
• Confidentiality obligations for all personnel handling data.
• Mandatory 24-72 hour breach notification windows.
• Assistance with Data Subject Access Requests (DSARs).
• Data deletion or return protocols after contract ends.

When a business relationship ends, the DPA dictates what happens to the remaining data. The processor cannot simply keep the data in their archives indefinitely. They must either delete it entirely or return it to the controller in a usable format.

This clause protects the controller from 'vendor lock-in' and ensures that the data subject's right to be forgotten is respected. The processor should provide a written certification that all copies of the data, including backups, have been purged.