What is Data Processing Agreement (DPA)?

A Data Processing Agreement (DPA) is a legally required contract between a data controller and a data processor under UK GDPR Article 28. It must be in place whenever a controller instructs a third party — such as a cloud software provider, marketing agency or payroll bureau — to process personal data on its behalf. The agreement must specify the subject matter, duration, nature and purpose of processing, the type of personal data and categories of data subjects, and the processor's obligations regarding security, sub-processors, data subject rights and assistance with breach notification. Controllers are responsible for selecting processors with appropriate technical and organisational security measures.