Glossary
Data processing addendum
Also called: DPA, data processing agreement
A data processing addendum is the contract between a controller and a processor governing how personal data is handled. GDPR Article 28 prescribes much of its content, and it is the document that turns a vendor's security claims into enforceable obligations.
Data processing addendum explained
What Article 28 requires
The subject matter and duration of processing, its nature and purpose, the types of personal data and categories of data subject, and the controller's obligations and rights. Then a set of processor commitments: process only on documented instructions, confidentiality of personnel, appropriate security measures, sub-processor controls, assistance with data subject rights, breach notification, deletion or return at the end, and information sufficient to demonstrate compliance.
The clauses that matter in an assessment
Sub-processor notice and objection. How much notice before a new sub-processor is engaged, and what happens if you object. Thirty days with a termination right is the common standard.
Breach notification timing. "Without undue delay" is the regulation's wording; a specific number of hours is what you want in the contract.
Audit rights. How compliance can be verified in practice — usually a report under NDA rather than a physical audit, which is reasonable, but it should be stated.
Deletion on termination. The retention window after the contract ends, and whether it can be shortened on request.
A practical signal
A vendor that publishes its standard addendum for review before contract is a vendor whose terms have been thought about. One that produces it only after a purchase order is one whose terms will surprise you.
FAQ
Data processing addendum: common questions
Will vendors accept our own DPA?
Larger vendors usually will not, because negotiating bespoke processor terms with every customer does not scale. Smaller vendors often will. Either way, read theirs before assuming.
Is a DPA needed if no personal data is involved?
Strictly no, but in a document system it almost always is — names, contact details and employment data appear in documents even when the system is not 'about' people.
Related terms
- 21 CFR Part 1121 CFR Part 11 is the FDA regulation governing electronic records and electronic signatures in regulated life sciences.
- Business associate agreementA business associate agreement is the contract HIPAA requires between a covered entity and any vendor that creates, receives, maintains or transmits protected health information on its behalf.
- eIDASeIDAS is the EU regulation establishing a framework for electronic identification and trust services.
- ESIGN ActThe ESIGN Act is the US federal statute giving electronic signatures and records the same legal effect as paper, provided the parties intended to sign and consented to transact electronically.
- GDPRThe General Data Protection Regulation governs the processing of personal data in the EU, with an equivalent UK regime.
- Golden threadThe golden thread is the requirement, introduced by the UK Building Safety Act 2022, to create and maintain accurate building safety information for higher-risk buildings throughout their life.
آخر مراجعة: 28 أغسطس 2026. Browse the full glossary.