Glossary/Privacy & Identity/Data Processing Agreement (DPA)
Privacy & Identity
Data Processing Agreement (DPA)
A contract between a data controller and processor setting out how personal data may be handled, as required by GDPR Article 28.
By Brandon Mina·CEO, BrandPilot AI·Updated November 2026
Short answer
A data processing agreement (DPA) is a contract between a data controller and a data processor setting out how personal data may be handled, as required by GDPR Article 28. It covers the subject matter, purpose, security measures, use of subprocessors and obligations at the end of the relationship, and is standard for marketing technology vendors.