Data Processing Agreement (DPA)
A legally binding contract between a data controller and a data processor that governs how personal data is handled. Required under GDPR whenever you share personal data with a third party that processes it on your behalf.
Why it matters
Without a DPA, transferring personal data to a vendor is a GDPR violation, full stop. A DPA defines processing purposes, security measures, sub-processor rules, data subject rights obligations, and breach notification timelines. It is the legal mechanism that extends your data protection obligations to every party in your processing chain. Regulators check for DPAs during investigations, and their absence is a common finding in enforcement actions.
In practice
Every vendor that touches personal data on your behalf needs a signed DPA. This includes cloud providers, analytics tools, email services, and payroll processors. Managing DPAs means tracking which vendors have them, when they expire, whether sub-processor lists are current, and whether the agreed security measures match reality. In vucavoid, third-party records track DPA status alongside risk and reliability scores, ensuring contractual coverage stays visible across your entire vendor portfolio.