Data Processing Agreement (DPA)

Also known as DPA

A Data Processing Agreement is the contract that names a vendor as a processor (or subprocessor) of personal data on your behalf, and sets the terms for how they handle it — retention, subprocessors, breach notification, deletion. Routing personal data to a third-party model API almost always brings that provider into this category, whether or not anyone thought of it as "processing personal data" at the time. Privacy and legal reviewers check that the specific model provider and product you're calling is actually named in the DPA, not covered by a generic reference to "AI features."

← Back to the full glossary