Data processing agreement (DPA)

Definition

A data processing agreement is a contract setting out how a supplier may process personal data on a customer’s behalf.

Required under GDPR whenever one company processes personal data for another. In practice it is a gating document in enterprise sales: the deal stops at the security review, not at the pricing page, when there is no DPA to sign.