# Data Processing Agreement (DPA)

Source: https://customlabs.io/glossary/data-processing-agreement/
Updated: 2026-09-13

Security & governance

# Data Processing Agreement (DPA)

Also known as DPA

A DPA is the contract naming a vendor as a processor of personal data.

It sets terms for retention, subprocessors, breach notification, and deletion.

Routing personal data to a third-party model API almost always brings that provider into this category.

Reviewers check that the specific model provider and product is actually named, rather than covered by "AI features."

[AI Security Review](https://customlabs.io/security-review/)

[← Back to the full glossary](https://customlabs.io/glossary/)

## Related terms

[Data Residency Data residency is where data is physically processed and stored, not where users are located.](https://customlabs.io/glossary/data-residency/)[AI Register An AI register is a current list of every system that touches a model.](https://customlabs.io/glossary/ai-register/)

## More in Security & governance

[Red Teaming Red teaming is deliberately attacking your own AI system to find what breaks first.](https://customlabs.io/glossary/red-teaming/)[High-Risk AI System A high-risk AI system is one classified as carrying enough decision impact to trigger heavier compliance.](https://customlabs.io/glossary/high-risk-ai-system/)[Human Oversight Human oversight is a checkpoint where a person can meaningfully approve, reject, or intervene.](https://customlabs.io/glossary/human-oversight/)[System Card A system card is a short document stating an AI system's purpose, limits, and owner.](https://customlabs.io/glossary/system-card/)