DPA (Data Processing Agreement)

A DPA, or Data Processing Agreement, is a legal contract between a data controller and a data processor that spells out how personal data gets collected, used, and protected. It exists to make each party’s responsibilities clear and to make sure personal information is handled properly.

HR teams need a DPA whenever they work with a third-party vendor that processes employee data, payroll providers, benefits administrators, and background check services are common examples. The agreement also assigns liability for data breaches and requires proper security measures across the whole data processing chain.