---
title: "Data processing agreement (DPA)"
canonical: https://replypen.com/glossary/data-processing-agreement
description: "A data processing agreement, or DPA, is the contract between a business and a service provider that handles personal data on its behalf."
question: "What is a data processing agreement (DPA)?"
author: "ReplyPen team"
published: 2026-09-30
operator: ProBackup BV (Hasselt, Belgium)
---

# What is a data processing agreement (DPA)?

A data processing agreement, or DPA, is the contract between a business and a service provider that handles personal data on its behalf. It sets out what the provider may do with the data, how it keeps it secure, which other companies it may involve, and what happens to the data when the service ends.

This is a general explanation, not legal advice. Under the [GDPR](https://replypen.com/glossary/gdpr.md) a DPA is required
whenever a processor handles personal data for a controller. Most software providers offer a
standard one, sometimes built into their terms, sometimes as a separate document to sign.

## Why it matters

A tool that reads customer email processes a lot of personal data. The DPA is where its promises
become obligations: that it uses the data only to provide the service, keeps it confidential,
reports a breach, helps you answer customer requests, lists its
[sub-processors](https://replypen.com/glossary/sub-processor.md) and tells you before adding new ones, and deletes or
returns the data at the end.

When comparing tools, the DPA is also where to look for limits on reuse, such as a
[no-training clause](https://replypen.com/glossary/no-training-clause.md).

## An example

Before connecting a drafting tool to the support inbox, a business asks for its DPA, checks where
the data is stored and which sub-processors are listed, and files a signed copy with its records.

**In ReplyPen:** Ask for the DPA at security@replypen.com. The companies involved are named on
[where your data goes](https://replypen.com/data-residency.md).

## Related

- [GDPR](https://replypen.com/glossary/gdpr.md): The GDPR, the European Union's General Data Protection Regulation, is the law that governs how organisations collect, use, store and share personal data about people in the EU.
- [Sub-processor](https://replypen.com/glossary/sub-processor.md): A sub-processor is a company that a service provider uses to process your data on its behalf, such as a hosting provider, an AI model provider or an email delivery service.
- [No-training clause](https://replypen.com/glossary/no-training-clause.md): A no-training clause is a contract term in which a provider promises not to use your data to train or improve its AI models.