Data processing agreement
A data processing agreement, also called a data processing addendum and often shortened to DPA, is the contract that binds a processor to a controller's instructions when the processor handles personal data on the controller's behalf, as Article 28 of the EU General Data Protection Regulation requires.
Submit a project See data security and complianceReviewed by Huy Nguyen (David), CEO · Updated 21 Oct 2026 · 4 min read
This term is one of the entries in the OutsourcingVN glossary of words buyers meet while checking a supplier's data-handling commitments.
Why does a data processing agreement matter?
Under the GDPR, a controller stays accountable for personal data even when a processor does the actual handling, so the agreement is where that accountability becomes enforceable rather than assumed. OutsourcingVN is operated by Netbase JSC, and the reason a buyer should read this document rather than accept a vendor's word is that Article 28 requires it to state the subject-matter and duration of the processing, its nature and purpose, the type of personal data and categories of data subjects, and the obligations and rights of the controller, and to bind the processor to act only on the controller's documented instructions, commit its staff to confidentiality, take the security measures of Article 32, help the controller answer data subjects' requests, delete or return the data at the end of the service and allow audits — specifics a sales conversation rarely covers.
What is an example of a data processing agreement in practice?
A retailer based in the Netherlands hires a supplier to build a customer support tool that will store shoppers' names, order history and contact details. Before any shopper data reaches the supplier's systems, the retailer and the supplier sign a data processing agreement naming what data is processed, for what purpose, for how long, and what happens to it at the end of the contract. When the supplier later wants to use a separate hosting provider to store backups, it needs the retailer's prior written authorisation, and the agreement's sub-processor clause decides its form: a specific approval of that provider, or a general authorisation under which the supplier must tell the retailer of the change in advance so it can object.
What are the common misreadings of a data processing agreement?
A data processing agreement is not a general confidentiality or non-disclosure agreement: an NDA protects business secrets between two parties, while a DPA specifically governs how one party may process personal data on the other's behalf, and a contract can need both. It is also not optional paperwork once a processor handles personal data on a controller's behalf: under the GDPR, Article 28 requires that processing to be governed by a written contract or other legal act setting out defined terms, not a verbal understanding or a general services agreement that never mentions data processing. A country outside the EU with its own data protection law may require an equivalent agreement under its own regulator's rules, which is a separate check from the GDPR one.
Plan the next step for your project
Common questions
The controller, who decides why and how personal data is processed, and the processor, who processes it on the controller's behalf and under its instructions.
Only with the controller's prior specific or general written authorisation. Under a general authorisation, GDPR Article 28(2) requires the processor to inform the controller of any intended addition or replacement of sub-processors, giving the controller the opportunity to object.
Which decisions does a data processing agreement affect?
Deciding what to ask a supplier for on data handling generally, beyond the DPA itself, is covered in the data security and compliance guide, and the outsourcing due diligence checklist covers where this document fits among the other evidence to request before signing a contract. The IP ownership guide covers the related question of who owns what is built. This page gives no legal advice; a buyer's own counsel should review the agreement a supplier proposes. When you know what personal data a project would touch, describe it and Netbase will respond through Netbase's own outsourcing-services platform; submit a project when you are ready.