What is a DPA?
Been asked by a customer whether you have a DPA? Here is what a Data Processing Agreement is, where it comes from and why you need one.
A DPA stands for “Data Processing Agreement”, sometimes also referred to as a “Data Protection Agreement”. If you are a start-up founder, app developer or software provider you may have come across this term in the course of business. What often isn’t explained is where this documentation standard originates from and why it is needed.
If you have been asked by a prospective customer or partner whether you have a “DPA” or not, the chances are you are providing a B2B or enterprise software service and are processing personal data on behalf of a customer.
Under GDPR (the General Data Protection Regulation), your customer is likely a **Data Controller** and you are likely their **Data Processor**, but this may vary depending on your exact service. The GDPR requires that where a controller uses a processor to process personal data on their behalf, that arrangement must be set out under a **contract** that specifies key details with respect to the full scope of processing.
There is no absolute rule that the DPA has to be a separate standalone document and many processors incorporate their DPA terms into their standard software licence agreements as an appendix. However a DPA has several key, mandatory requirements that must be included by law and as a result it usually makes sense to keep this as a standalone document to ensure it stays compliant.
If you need a DPA for your business, take a look at our indicative fees for this work or otherwise feel free to book a call to discuss your requirements further. If you’re a new business and on a budget, let us know and we will do our best to accommodate.