A Data Processing Agreement is a legally binding document to be entered into between a data controller and a data processor when required by the GDPR.

In article 28(3) GDPR it is stated that a data processing agreement is a requirement if a controller wants to let a processor process their personal data. The article also states which information must be a part of the DPA.

A controller needs to notice that a separate data processing agreement needs to be written with each processor that process the controllers’ data.