Data Processing Agreement (DPA): What It Is, Who Needs One, and What to Include

If you use any SaaS tool that handles customer data, you probably need a Data Processing Agreement. Most businesses either don't have them or don't know they do. What Is a Data Processing Agreement? A Data Processing Agreement (DPA) is a legally binding contract between two parties: a data controller (the business deciding how data is used) and a data processor (a vendor or service processing data on the controller's behalf). Under GDPR Article 28, entering into a DPA with every processor you use isn't optional — it's a legal requirement. The DPA specifies what data is processed, why, how it's protected, and what the processor's obligations are. The good news: a DPA doesn't have to be a 40-page legal document. Most reputable SaaS companies already have standard DPAs you can sign in minutes. You don't need to draft one from scratch for every vendor relationship. What you do need to do is actually have them in place. Controller vs. Processor — The Distinction That Matters Before you can