Skip to content

What is Data processing agreement (DPA)?

A data processing agreement is the contract required by Article 28 of the GDPR between a controller and a processor, setting out what the processor may do with personal data, on whose instructions, with what security, and what happens at the end.

Updated

  • DPA
  • Auftragsverarbeitungsvertrag
  • AVV
Your organisation decides; Enclessa processes on your documented instructions.

Compliance

Data processing agreement (DPA), explained

The article prescribes the contents rather than the wording, which is why every vendor’s DPA covers the same eight or nine topics: subject matter and duration, the nature and purpose of processing, categories of data and data subject, processing only on documented instructions, confidentiality of personnel, the security measures of Article 32, the rules for engaging subprocessors, assistance with data-subject rights and breach notification, and deletion or return at the end of the contract.

How Enclessa uses it

Enclessa provides a data processing agreement as part of the terms of service, forming the Article 28 contract for everything a customer organisation puts into the platform. The document is published and in force, and has not yet had an external legal review. The security page describes how to request a signed counterpart.