Hiring
What is a DPA and do I need one?
A Data Processing Agreement is a contract setting out how a supplier handles personal data on your behalf: what they may do with it, what security they apply, who else can see it, and what happens on a breach. You need one whenever a supplier processes personal data for you.
What a usable DPA contains
- The roles — you are the controller, the supplier is the processor
- The categories of data and the purposes it may be used for
- Technical and organisational security measures, described rather than asserted
- A named sub-processor list, with notice before additions
- Breach notification timescales
- The transfer mechanism where the supplier is outside your jurisdiction
- What happens to the data at the end
The signal it gives you
A supplier who can produce one immediately has done this before. A supplier who asks you to send one, or who has never been asked, is telling you something about the size and type of client they usually work with.
Where it fits with everything else
The DPA governs data. Your scope and quote govern the work. Terms of business govern the commercial relationship. All three should exist before money changes hands.
The longer version
This answer is deliberately short. If you want the full treatment, Hiring an offshore developer: the questions that protect you covers it in about 4 minutes — free, ungated, written from client work.
Who answered this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan — fifteen live client sites, six of them stores taking real payments. These answers come from those projects rather than from a content brief. More about how I work, or ask me something directly.