What is a DPA (data processing agreement)?

In practice

The clauses that matter in practice are the sub-processor list and how changes to it are notified, the international transfer mechanism, the breach notification window, the deletion and return terms, and audit rights. A supplier who cannot produce a current sub-processor list is telling you something about how well they know their own stack.

Where it fits in a build

Required for essentially any supplier touching customer, employee or user data — which includes most software, hosting, support and marketing suppliers. Procurement teams generally read it before they read the proposal.

Common mistakes

• Signing a DPA that names no sub-processors, then discovering data is processed in four countries.
• No process for reviewing sub-processor change notices, so they arrive and are ignored.
• Treating it as a formality separate from how the system is actually built.

Related terms

• Data residency
• Personally identifiable information (PII)
• Least privilege

Working on something that involves this?

ASTACKRA designs and builds AI systems, automation and custom software for businesses that need technology shaped around their own workflow. If this term turned up in a proposal and you want a straight answer about whether it applies to your situation, ask us — no obligation, and we will tell you if the answer is no.