data processing agreement (DPA)

advancedwidespread

A written contract specifying the conditions and limitations under which an external provider may handle personal data entrusted to it on behalf of the client.

In plain terms

If a company entrusts personal data it holds (data of customers, employees, patients) to an external provider, their relationship must be defined in a contract. This is the data processing agreement. The commissioning company is the data controller: it decides how the data is used. The provider is the data processor: it only executes.

It is like handing your apartment key to a cleaning company. They can enter, but only to clean: they cannot look into drawers, cannot give the key to anyone else, and must return it after the work is done. The agreement describes these rules for data.

This is particularly important for AI tools. If a company uploads customer data into a chatbot, AI assistant, or agent, the AI provider typically becomes a data processor. The agreement specifies, for example, whether the model can be trained on this data, how long it is kept, and where it is stored. If the provider also uses the data for its own purposes, such as training its model, it is no longer a data processor for that use but becomes a data controller itself.

How it works

The parties specify exactly what data, whose data, for what purpose, and for how long.
The service provider undertakes to process data only according to the client's written instructions, not to use it for its own purposes, and its employees are bound by confidentiality.
They establish security measures (for example, encryption, access restrictions). They also stipulate that the provider may involve additional data processors (sub-processors) only with the prior written consent of the controller. This consent may be specific or general. In the case of general consent, the provider must notify the controller of the change in advance, and the controller may object.
The provider undertakes to notify without undue delay in the event of a data breach, assist in fulfilling the requests of affected persons (such as deletion or access), and allow the client to verify compliance.
At the end of the contract, the service provider deletes or returns the data at the client's choice and also deletes existing copies, unless law requires their retention.

An everyday example

Your workplace introduces an AI assistant that summarizes customer service emails. Before going live, the company's lawyer signs a data processing agreement with the AI provider because the emails contain names, addresses, and complaints. If this is missing, the company commits a violation, even if no data leaks out.

Who is affected

entrepreneur, executiveIf your company has an external AI or cloud provider process personal data, a data processing agreement is mandatory. If it is missing, the company, as data controller, is liable, possibly with a fine.

developerBefore sending real customer data to an AI provider's API or an agent, you must verify that a valid agreement exists with that provider. → Code

employeeIf you copy customer data into a free chatbot with which your company has no agreement, you may unintentionally violate data protection rules. → Work & HR

lawyer, citizenThis contract also protects your data when a company does not handle it itself but passes it to a provider. → Law

A common misconception

MythOnce we have signed the agreement with the provider, they are responsible for the data from now on, and we have nothing more to do.

In realityThe main responsibility remains with the data controller, i.e., the client company. It must choose a reliable provider and also verify that the provider fulfills its commitments. The provider may additionally be separately liable for its own obligations.

Limits and risks

An agreement on paper does not prevent data leaks by itself; it only records obligations and liability.
Major AI and cloud providers mostly supply their own pre-written text, which a smaller company can barely alter, so you must read it carefully.
Free AI tools intended for private individuals typically do not come with such an agreement, so they are generally unsuitable for processing corporate personal data.
If the data leaves the European Economic Area and the destination country has no EU adequacy decision, the agreement alone is not enough: separate data transfer safeguards are also required, such as standard contractual clauses for data transfers.

Similar, but not the same

data processing notice – The information notice is for you, the data subject, about what happens to your data, while the agreement is a contract between two companies.
non-disclosure agreement (NDA) – An NDA protects trade secrets, and the parties freely agree on its content. A data processing agreement, however, concerns personal data, and its mandatory minimum content is prescribed by law.
general terms and conditions – The Terms and Conditions (T&C) regulate the use of the entire service (fees, liability, termination), while the data processing agreement covers only the handling of personal data, often as an annex to the T&C.

Related concepts

Broader

data protection, General Data Protection Regulation (GDPR), compliance

Narrower

sub-processor, general terms and conditions, data retention period

On the edge

data controller, data processor, data protection impact assessment, data breach, personal data

A brief history

The conclusion of a data processing contract was already required by the EU's 1995 Data Protection Directive (95/46/EC). The current, detailed content requirements are set out in Article 28 of the GDPR, adopted in 2016 and applicable from 25 May 2018. The European Commission issued a model text (standard contractual clauses) for this in 2021; its use is not mandatory.

Where things stand

As of late 2026, this is a standard contractual element of business cloud and AI services, and the major providers offer ready-made text for their business packages. For AI, the key questions are whether the model is trained on submitted data and how transparent the chain of additional providers brought in by agents is.

Status: 2026 November

Also known as

data processing agreement · data processing agreement · data processing agreement · data processing agreement · DPA · data processing agreement · data processing addendum · contract under Article 28 of the GDPR

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.