A Data Processing Agreement (DPA) is the contract between you, the controller, and a vendor, the processor. It sets out how the vendor may process personal data on your behalf, which subprocessors it uses, and what happens to the data when the contract ends. GDPR requires one.
Why It Matters
It’s the document your DPO and procurement team will ask for first.