Skip to content
    Flow-alerta.cab

    Data Processing Agreement (DPA)

    Application & enablementAVVData Processing AgreementContract for order processing
    Editorially reviewed on: 1 source
    Your reading view

    The short answer · 15 words

    In short

    A DPA governs how a service provider processes personal data on behalf of a controller.

    Flow-alerta.cab (2026): Data Processing Agreement (DPA). https://flow-alerta.cab/en/glossar/data-processing-agreement-dpa. Editorially reviewed on: 10 October 2026.

    How much detail would you like?

    Practical

    AVV and facilities create comprehensible responsibilities for cloud, hosting, support or AI services. They do not replace the verification of the service provider, nor the legal basis, risk analysis and practical controls.

    A CRM provider processes customer data for a company; the AVV describes instructions, protection measures, subcontractors, support and deletion.

    SMEs maintain a directory of service providers, clarify roles before concluding contracts and keep technical and organisational measures, subcontractors and deletion processes up-to-date.

    At a glance

    Core
    In the GDPR context, the data processing contract is a binding contract or other legal instrument in accordance with Article 28. It shall specify, inter alia, the subject matter, duration, nature, purpose, types of data, data subjects and rights and obligations. It is not a general data exchange agreement.
    Use
    AVV and facilities create comprehensible responsibilities for cloud, hosting, support or AI services. They do not replace the verification of the service provider, nor the legal basis, risk analysis and practical controls.
    Example
    A CRM provider processes customer data for a company; the AVV describes instructions, protection measures, subcontractors, support and deletion.
    Limits
    Accept a template unchecked, incompletely describe processing and subcontractors or treat the AVV as full proof of compliance. DPA can also designate other contracts internationally.

    In context

    General Data Protection Regulation (GDPR)

    European Regulation on the standardisation of the protection of personal data of natural persons.

    Questions about this term

    When do you need an AVV?

    Where a processor processes personal data on behalf of the processor.

    Is it enough to submit a proposal?

    No, processing and roles have to fit.

    Is every data service order processing?

    No, the actual distribution of roles decides.

    All details and background

    In the GDPR context, the data processing contract is a binding contract or other legal instrument in accordance with Article 28. It shall specify, inter alia, the subject matter, duration, nature, purpose, types of data, data subjects and rights and obligations. It is not a general data exchange agreement.

    ELI5 – Explained simply

    A company gives a service provider data for editing and writes down what it can and must do with it.

    Why it matters in practice

    AVV and facilities create comprehensible responsibilities for cloud, hosting, support or AI services. They do not replace the verification of the service provider, nor the legal basis, risk analysis and practical controls.

    Example

    A CRM provider processes customer data for a company; the AVV describes instructions, protection measures, subcontractors, support and deletion.

    Pitfalls and limits

    • Accept a template unchecked, incompletely describe processing and subcontractors or treat the AVV as full proof of compliance. DPA can also designate other contracts internationally.

    Origin & history

    Article 28 of the GDPR, which has been applicable since 2018, specifies the contractual binding of processors. Standard contractual clauses can support content, but do not replace the examination of the concrete relationship.

    Use in mid-sized companies

    • SMEs maintain a directory of service providers, clarify roles before concluding contracts and keep technical and organisational measures, subcontractors and deletion processes up-to-date.

    Related terms

    • Accountable person
    • Processors
    • GDPR
    • TYPE
    • Sub-processors

    Matching Flow-alerta service

    TrainingData protection-oriented process and tool verification: Record data flows, roles, service providers and required evidence in a structured manner.

    Matching tool / use case

    View use casesDirectory and contract checklist; use case: check cloud and AI service providers for roles, data flows and AVV systems before productive use.

    Sources

    Quellenprüfung: 10.10.2026. Definition und dokumentierte Einordnung abgeglichen; Beispiele beschreiben mögliche Anwendungen.

    Editorially reviewed on:

    Next step

    Put knowledge into practice

    Discuss your projectView use cases