DPA
DPA most often means a Data Processing Agreement, the contract Article 28 of the GDPR requires between a controller and a processor; the same initials also stand for Data Protection Authority, the national regulator.Data Processing Agreement. Article 28(3) of the GDPR requires a written contract whenever a controller uses a processor. It must set out the subject matter, duration, nature and purpose of the processing, the types of data and categories of people, and the processor's obligations: act only on documented instructions, ensure confidentiality, implement security measures, use sub-processors only with authorization and under the same terms, assist with rights requests, breach notifications and impact assessments, delete or return the data at the end, and allow audits. Most vendors publish a standard DPA that the customer accepts online. For data leaving the EEA, standard contractual clauses or another transfer tool are attached. A website owner should hold a DPA with its host, its consent platform, its analytics and email providers, and any vendor that processes visitor data for it; advertising platforms that act as controllers offer controller-to-controller terms instead. Brazil's LGPD and Türkiye's KVKK expect similar contracts, and California's CCPA requires specific terms in service provider contracts, the absence of which featured in the Honda and Tractor Supply penalties of 2025.
Data Protection Authority. In EU usage DPA also means the national supervisory authority, such as the CNIL or the Irish DPC. Context usually makes clear which DPA is meant.