📝
Data Processing Agreement (DPA)
Law
Contract governing processor obligations (security, sub-processors, assistance, breach notice, retention) for handled personal data.
Definition
DPAs define how processors handle personal data: processing instructions, security measures, sub-processor controls, audit rights, deletion/return terms, and breach notification obligations.
In plain English
Contract governing processor obligations (security, sub-processors, assistance, breach notice, retention) for handled personal data.
Why this matters
Why it matters: Contracts shape real safeguards and accountability in vendor ecosystems.
Example
Example: A controller requires a processor to encrypt data, limit retention, notify within set timelines, and flow down requirements to sub-processors.