DPA

Data Processing Agreement

Contract under GDPR between controllers and processors.

When you'd see it: Vendor contracts under GDPR. Any time your company hands personal data to a vendor (a SaaS tool, a payroll provider), a DPA governs it.

Why it matters: A DPA binds a vendor (the processor) to handle personal data only as instructed and to protect it. Under GDPR it is mandatory, which is why procurement asks for one before a tool touches user data.