← Full glossary
Book a demo
Data processing agreement (DPA)
The written agreement that Article 28 of the GDPR requires between a controller and a processor. It must define the subject matter and duration of the processing, the types of data, the processor's obligations, security requirements, rules for sub-processors, and assistance with data breaches and access requests. Without a valid DPA it is unlawful to let a vendor process personal data on the company's behalf. The Danish Data Protection Agency has published a standard template that many SMEs use as a starting point.
Related module
Want to see it before you try it?
Book a 30-minute demo where we walk through the platform using your industry as the example and answer compliance questions along the way.
Jonas Jensen, founder of Verkta