Data Processing Agreement (DPA)

A data processing agreement (DPA) is a contract between a data controller and a data processor that sets out how personal data may be handled, as required under privacy laws such as GDPR.

A DPA defines the scope, purpose, and security measures for processing, and binds the processor — for example an AI-agent vendor — to act only on the controller’s instructions.

It is a standard part of enterprise procurement whenever a vendor will process personal data on a customer’s behalf.