What is a DPA(data processing agreement)?

The Data Processing Agreement (DPA or data processing agreement) is one of the essential GDPR documents that accurately regulate the cooperation between data controllers and data processors. Its main function is to guarantee the compliance with protection of personal data in the processing steps. 

Key aspects of a Data Processing Agreement include:

• Legal requirements: The regulation also requires that article 28 of the GDPR that any data controller who contracts with a data processor must have a data processing agreement in place.
• Parties involved: 

A Data Processing Agreement outlines the following:

• The subject matter and duration of the processing
• The nature and purpose of the processing
• The types of personal data involved
• The categories of data subjects
• The obligations and rights of the controller

It is noteworthy that the Data Processing Agreement contains important provisions concerning obligations of data processors. The processor must:

• Undergo data processing activities only in compliance with instructions received from the controller
• It is important to preserve data security
• Ensure the right security procedures
• Help the controller meet the data subject rights obligations
• Destroy or relinquish all collected information at the cessation of the service provision

DPAs are required in the situations where an organization stores its clients data on cloud, providing marketing firms with access to clients databases, or employing web analytics tools which gather users data. 

A DPA can be considered a strategic tool for achieving compliance with the GDPR, clearly defining roles and responsibilities as well as protecting personal data within the entire data processing process.