What is a DPA?

A GDPR data processing agreement (DPA) is a legal contract a company must sign when using a third-party data processor. The contract ensures that the data processor will follow GDPR guidelines when handling data. A DPA spells out processing activities duration, the scope of the data, the purpose, and any other entities that can access it.
In Europe, it is legally required to have a DPA. Other regions may not require it, but it’s strongly recommended that all parties understand their responsibilities around collecting, using, and protecting personal data. Companies also need to know the consequences they’ll face if data is compromised.

What is GDPR?

GDPR or General Data Protection Regulation is a privacy and security law passed by the European Union (EU). GDPR applies to any organization that markets to or collects data about EU citizens.

GDPR regulates personal data and data processing, subjects, controllers, and processors. The overall goal is to protect users’ data. Any organization that uses EU residents’ data must be GDPR compliant and use DPAs.

What happens if you don’t sign a DPA?

If a company doesn’t sign an agreement with its data processor and misuses or mishandles the data, they are liable for any data breach.

Along with financial repercussions, companies will face damage to their reputation and could lose customers’ trust in sharing their personal information with the organization.

What is a data processor?

A data processor is a third-party service provider that processes data for the controller (or company). The data processor must handle the data according to the DPA created by the data controller. When the contract ends, the data processor must delete or return the processed data.

What are the elements of a DPA?

A DPA should include the scope and purpose of the data processing, which data will be processed, how the processor will protect the data, and the relationship between the processor and controller.
Under GDPR, a DPA must include:

• General information: all the actions in the data processing, how the data will be used, who is responsible for ensuring GDPR compliance, how long processing will occur, and other details related to data
• Processor responsibilities: maintaining information security, working with authorities during inquiries, reporting data breaches, preparing for audits, deleting or returning data at the end of the contract, and more
• Technical and organizational obligations: planning how data will be encrypted, accessed, and tested, establishing confidentiality, integrity, and safety of data processing systems, understanding the costs of implementation, and so on

How to create a DPA as a processor?

Data processing companies will want to be familiar with the best practices for creating and ensuring the effectiveness of DPAs.

Contractors can start by taking inspiration from DPAs created by other processors. Some companies publish their DPAs and make them accessible to anyone with internet access. Reading a few DPAs is a great start, though each company may need unique components to cover its data usage needs. Top-tier payroll and HR solutions can help companies manage contracts, create more transparency, and prevent errors.