Data governance - Document
DPA
(Data Processing Agreement)
A contract defining how another organisation may handle personal information on your behalf
What's it for?
Sets legal rules for how a supplier may handle personal information on an organisation's behalf.
For example…
Signing up for an email marketing platform includes a DPA stating they only process contact lists as instructed and will delete them on exit.
A company signs a DPA with its payroll provider specifying what employee data may be processed, how it must be protected and what happens when the contract ends.
Think of it like…
Written house rules for a cleaner who handles your post: what they may touch, how they lock up, and who else they can bring in