What Is a DPA?

A Data Processing Agreement (DPA) is a legal contract between a data controller (a company collecting personal data) and a data processor (a vendor handling that data on the controller's behalf) that defines how the data may be used, protected, and deleted. GDPR requires a DPA to be in place with any third-party vendor that processes personal data.

A DPA is a paperwork requirement, but not just paperwork: it’s the mechanism that makes a company’s vendors legally accountable for how they handle data passed to them. Having a signed DPA on file doesn’t verify that a vendor’s tag actually behaves within those terms, though; that verification is a technical question, answered by Payload Inspection, not a contractual one.