Data processing agreement (DPA)

How a data processing agreement works

Data protection law splits responsibility between two roles. The controller decides why and how personal data is processed. The processor handles the data on the controller's behalf. Ireland's Data Protection Commission describes the DPA as the legally binding contract required when a controller engages a processor to process personal data on its behalf 3.

The obligation starts before the contract. Article 28 says a controller may only use processors that provide sufficient guarantees of appropriate technical and organizational measures 1. The DPA is where those guarantees are written down, and it must be in writing, which includes electronic form 1.

The contract has two layers. The first describes the processing itself, which means the subject matter and duration, the nature and purpose, the type of personal data, the categories of people and the controller's rights and obligations 1. The second lists terms the processor has to accept 1.

• Instructions. The processor acts only on documented instructions, including for transfers outside the EU, unless law requires otherwise 1.
• Confidentiality. People authorized to handle the data are bound to confidentiality 1.
• Security. The processor takes the measures required by Article 32 1.
• Subprocessors. It follows the rules for engaging other processors 1.
• Assistance. It helps the controller answer data subject requests and meet its duties under Articles 32 to 36 1.
• End of service. It deletes or returns the data at the controller's choice and deletes existing copies 1.
• Audits. It provides the information needed to show compliance and allows audits and inspections 1.

Subprocessors get their own rules. A processor may not engage another processor without the controller's prior specific or general written authorization 1. Under a general authorization, it must tell the controller about intended changes so the controller can object 1. The same obligations flow down to the subprocessor, and the original processor stays fully liable for that subprocessor's performance 1.

The roles depend on what the vendor does. A processor that starts deciding the purposes and means of processing on its own is treated as a controller for that processing 1. That matters for data enrichment, where a B2B data provider can run lookups on a customer's instructions while also holding data of its own. Each flow needs its role worked out before the contract is signed.

This page explains how the contract is structured for data teams. It is not legal advice.

What to check in a vendor DPA

Article 28 fixes most of the content, so DPAs from different vendors look alike on the surface 1. Six sections deserve the closest read.

**Instructions and purpose.** The processor may process personal data only on documented instructions 1. Look for clauses that let the vendor reuse customer data for its own products. A vendor that decides its own purposes for that data is acting as a controller for that processing 1.

**Subprocessors.** Check whether the authorization is specific or general, how much notice the vendor gives of changes and how an objection works 1. Ask for the current list. For a waterfall enrichment API, the list should cover infrastructure vendors as well as the data sources a lookup can reach.

**Transfers and location.** Instructions have to cover transfers to third countries 1. Ask where the API runs and where lookups are processed. RichAPI runs its API infrastructure on AWS in the EU region and states that some third-party data sources process lookups outside the EU 4.

**Deletion and retention.** At the end of the service the processor deletes or returns the data, at the controller's choice 1. Retention during the service matters too. RichAPI purges request logs after 30 days 4.

**Audit and evidence.** The processor has to make available the information needed to show compliance and allow audits 1. That can mean a security report, a penetration test summary or answers to a questionnaire.

**Optional terms.** The Data Protection Commission lists liability provisions, detailed security provisions and extra cooperation terms as common additions beyond the legal minimum 3.

Parties do not have to draft from scratch. The contract may be based in whole or in part on standard contractual clauses, and the Commission adopted a set for controllers and processors on 4 June 2021 12.

Example of a DPA review for an enrichment API vendor

A RevOps team wants to add an enrichment API to its stack and route new CRM contacts through it. Procurement sends the vendor DPA to legal with a short checklist.

Clause                 Vendor answer                          Status
Subject and duration   enrichment lookups for contract term   ok
Data types             names, work emails, profile URLs       ok
Instructions           lookups only on customer API calls     ok
Subprocessors          main vendors named, full list on ask   ok
Transfers              EU hosting, some sources outside EU    flag
Retention              request logs purged after 30 days      ok
End of service         delete or return on request            ok
Audit                  security report on request             ok

The first three rows map to the description Article 28 requires, covering what is processed, for how long and on whose instructions 1. Legal checks that the data types match what the team will send. Names, work emails and profile URLs are personal data, so the DPA has to cover them.

The subprocessor row is checked against the vendor's published list. RichAPI's security page names AWS, Cloudflare, Supabase, Stripe and Sentry as its main infrastructure vendors and offers a detailed list for security reviews 4.

The transfer row is flagged, not rejected. The vendor states that some third-party data sources process lookups outside the EU 4. Legal confirms how those transfers are covered before sign-off.

The audit row is answered through the parent company. RichAPI holds no certification of its own, and enterprise customers can request TexAu's SOC 2 report and penetration test summary 4. That goes into the vendor file with the signed DPA.

Once signed, the DPA joins the team's privacy records alongside the legitimate interests assessment for each campaign. A later change, such as connecting the same vendor through an MCP server for an agent, is checked against the DPA's description of the processing before it goes live.