Definition
A DPA is a contract that governs how a vendor processes personal data on your behalf, defining purpose, security, sub-processing, and breach obligations.
Under laws like GDPR a DPA is mandatory when a vendor touches personal data. Scrutinise the sub-processor list, the breach-notification window, and - for AI vendors - explicit terms that your data is not used to train models.
Go deeperVendor due diligence checklistRelated terms
From definition to deal
Benchside turns data processing agreement into the exact questions, exclusions, and lock-in math for your specific vendor - your first project is free.