Data Processing Agreement

A data processing agreement (DPA) is a contract between a data controller and the processor handling data on their behalf, setting out for what purpose, how, and with what safeguards the data is used.

A DPA is what turns the controller-processor relationship from a verbal understanding into a written commitment. Its core is that the processor acts only on the controller's instruction, does not use the data for another purpose, and is committed to its security and deletion. For a business using an analytics tool, this contract is where responsibilities become clear: who owns the visitors' data, who must obtain consent, and what the tool may and may not do with the data. The common trap is assuming that having a DPA means “everything is lawful”; but a DPA only regulates the relationship between the two parties and does not remove the controller's primary responsibility toward the end user.