Data processing agreement (DPA)
Definition
A data processing agreement is the binding contract in which a controller instructs a processor and sets the mandatory terms for processing personal data on its behalf.
GDPR Art. 28(3) lists the minimum content: subject matter, duration, nature and purpose of processing, types of data and categories of individuals, and commitments that the processor acts only on documented instructions, ensures confidentiality, implements security measures, uses sub-processors only with authorisation and equivalent terms, assists with data subject requests and DPIAs, deletes or returns data at the end, and allows audits. The Commission also published standard clauses for this contract (Implementing Decision 2021/915).
The LGPD is less prescriptive: Art. 39 requires the operator to follow the controller's lawful instructions, and Arts. 42 and 46 address liability and security. In practice, Brazilian contracts cover the same topics as GDPR agreements.
For AI services, the agreement should state whether the vendor may use customer data to train or improve its models, where data are stored, retention of prompts and logs, and incident notice obligations. Example: a company adopting a hosted transcription service negotiates a clause prohibiting reuse of recordings for model training.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 5: International transfers and vendors.
Also covered in: Responsible AI Practitioner (RAIP), Responsible AI Auditor (AUDAI)
Primary sources
- GDPR Art. 28(3)
- LGPD Art. 39
- Commission Implementing Decision (EU) 2021/915