You are about to close a deal with a new customer or vendor when their legal team sends you a DPA for signature. You’re uncertain what it commits you to and whether the terms are standard or negotiable. DPAs are everywhere in B2B SaaS, but founders may not have seen enough of them to know what’s typical and what's not.
This article explains what a DPA is, who the key parties are, when US businesses are legally required to have one, and what to check before signing.
What is a data processing agreement (DPA)?
A data processing agreement (DPA) is a contract between a data controller and a data processor. The DPA identifies precisely what data is being processed and for what purpose. It specifies the restrictions that apply and spells out the security obligations of the party processing the data. Most privacy laws require a DPA to be in place before any personal data may be transferred to a third party.
Who are the key parties?
The parties to a DPA are referred to differently in distinct jurisdictions. The EU’s General Data Protection Regulation (GDPR) and many US state laws use the term “controller” to describe the party deciding how and why the data will be processed and “processor” to describe the party handling the data. One exception is California, in which the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) refer to the controlling party as the “business” and the party processing the data as the “service provider” or “contractor.”
In practice, the controller is usually the business collecting consumer or employee data, and the processor is the vendor hired to handle that data. For example, processors or service providers such as Stripe, HubSpot, Mailchimp, AWS, and Dropbox typically process a controller’s customer data according to the controller’s instructions, the details of which are documented in the DPA.
Why are DPAs important?
A DPA places enforceable obligations on the service provider if they fail to abide by its terms. The DPA specifically lays out what the contractor/processor is permitted to do with consumers' data and ensures they help the controller honor consumers’ or employees’ right to access, correct, and delete that data. Because privacy laws often hold the business or controller responsible for contractor misconduct, a DPA limits exposure and provides an avenue for recourse for resulting losses.
When is a US business required to have a DPA?
A DPA must be in effect any time you share personal data with a third-party processor. The law that governs your obligation depends on your customers.
US state privacy laws
California’s CCPA, as amended by the CPRA, mandates DPAs with every service provider and contractor that receives any personal information from your business. The contracts must:
- Restrict processing to authorized purposes only
- Prohibit the sale or retention of data not provided for in the agreement
- Require the processor to cooperate with consumer rights requests
- Permit compliance audits.
Similar requirements are included in Virginia’s Consumer Data Protection Act (CDPA), theColorado Privacy Act (CPA),Connecticut’s Data Privacy Act (CTDPA), andUtah’s Consumer Privacy Act (UCPA). More than 20 other states have enacted or are considering privacy laws with comparable provisions.
What if you serve EU or UK customers?
If EU or UK residents are among your customers, the EU’s or the UK’s GDPR governs data protection and privacy obligations, regardless of where your business is located. Startups seeking SaaS customers in Europe need to be aware that their first EU or UK customer triggers GDPR requirements.
Article 28 of the GDPR requires data controllers and data processors to sign a binding DPA requiring the processor to follow the controller’s documented instructions, mandatingdata security measures, and requiring controller approval of sub-processors.
Which vendor relationships typically trigger a DPA?
Most startups need DPAs to conduct business with a good deal of their vendor stack. That includes vendors providing payment processing, email and marketing tools, cloud infrastructure, payroll, IT support, and customer service software.
Most major service providers, such as PayPal, Salesforce, and AWS, submit standard DPAs to new business clients.
But many standard DPAs contain low liability caps that may be worthless in the event of a data breach. Others may allow the processor to use customer data for their own analytics or product improvement.
What are high-risk processing triggers?
Some processing activity is inherently higher risk than others. Sensitive data, such as healthcare information, financial data, and biometrics, often triggers stricter requirements under state law. Virginia, Colorado, and Connecticut are just a few of the states that require “opt-in consent” before processing certain sensitive data.
Other high-risk processing functions involve large-scale behavioral monitoring, dataset matching, and automated decision-making.
What should a data processing agreement include?
US, EU, and UK law reveals that GDPR Article 28, CCPA service-provider provisions, and the US state laws modeled on California all require DPAs to include a similar set of core elements:
Core processing details and roles
Every DPA should document the scope of the processing relationship, as well as the duration, nature, and purpose of the processing. It should also describe the types of personal data entrusted to the service provider, the categories of customers, and each party’s role. Specific processing descriptions prevent ambiguities from being interpreted against the business if a dispute arises.
Processor obligations
The service provider must agree to some minimum obligations:
- Processing data based on documented instructions
- Binding personnel to confidentiality
- Assisting with consumer or data subject rights requests
- Providing prompt notification in the event of a breach
- Cooperating with audits
- Returning or deleting data when the contract ends
It is essential that the timing of breach notification be clearly stated. The GDPR requires controllers (businesses) to notify the appropriateEuropean national data protection authority within 72 hours of discovering a breach. Controllers should ensure breach notification terms leave enough time to comply with the EU’s deadline. Missing the deadline exposes the controller to fines of up to €10 million or 2% of global annual turnover, whichever is higher.
The US has no blanket federal rule; all 50 states have their own laws with different notification deadlines, such as 30 days in the strictest cases (California, Colorado, Florida, Washington, and New York). California also mandates notification to the state’s attorney general within 15 calendar days for breaches affecting more than 500 state residents.
Security and liability terms
Your DPA should specify the security practices your service provider must uphold: how your data is encrypted, who can access it, how long they can keep it, and how they will maintain accuracy.
Liability terms are another important provision. Vendors that supply their own DPAs often cap the processor’s liability at the amount of fees paid under the contract. If a sensitive data breach occurred involving thousands of customers, that liability limit likely would be inadequate.
Sub-processor approval and oversight
Most SaaS service providers use their own vendors, or sub-processors, to handle clients’ data. Whether in the US, Europe, or the UK, the DPA should clearly state whether prior approval is required to engage a sub-processor. The DPA’s terms should require that the service provider deliver a current sub-processor list and advance notice of any changes, and entitle the other party to object. The service provider should also contractually require sub-processors to meet the data protection obligations as the primary contractor.
What you need to know about cross-border data transfers?
This section applies only if you process the personal data of EU or UK residents.
When do standard contractual clauses apply?
Under the GDPR, the EU assesses the thoroughness of a country’s data protection and privacy laws, then issues an “adequacy decision” to approved frameworks. The US has no GDPR adequacy finding. Instead, the EU and US agreed to a Data Privacy Framework (DPF) in 2023, which allows US companies to self-certify that they comply with GDPR standards.
If your business or your vendors aren't DPF-certified, EU-to-US data transfers must be covered by Standard Contractual Clauses (SCCs), pre-approved contract terms from the European Commission that are incorporated into or attached to the DPA. The UK operates similarly but requires the use of an International Data Transfer Agreement (IDTA), or a UK Addendum to EU SCCs. The addendum states that the SCCs must also comply with UK law.
Transfer mechanics and what controllers should review
SCCs come in sections corresponding to different scenarios, depending on the parties’ roles: controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller. Each track requires completing annexes documenting processing details, security measures, and sub-processor information.
Before signing any DPA involving EU or UK data, confirm the processor's security practices are appropriate for the data's sensitivity and verify that the chosen transfer mechanism actually applies and is properly documented. Ensure the vendor’s permitted use is limited to purposes you authorize. Finally, review the liability allocation carefully, understanding that controllers carry substantial exposure if the processor causes a breach.
How to use a data processing agreement template correctly
Editable templates work well for routine vendor relationships. There are also reliable cross-jurisdictional templates covering GDPR Article 28 and US state law requirements.
However, if your transaction involves a higher-stakes relationship, enterprise customers, or any sensitive data, a template is only a useful starting point. You should have it reviewed before signing.
Whichever template you choose, fill in the processing details completely and confirm the structure matches the relationship (controller-to-processor versus controller-to-controller). If EU or UK transfers are involved, you must ensure the appropriate SCC modules and their annexes are fully complete. Templates are not a substitute for legal advice.
Work with Crosby and sign DPAs with confidence
Startup founders sometimes receive DPAs faster than they can review them. Each one imposes its own service-provider restrictions, sub-processor lists, SCC annexes, and liability allocations. With so many issues competing for their attention, founders can’t process all of this information manually.
Let Crosby handle the redlining for you. Crosby combines AI-powered analysis with the expertise of barred attorneys who oversee the work on DPAs and other legal documents. Fixed, per-document pricing with fast turnaround—often under four hours.
Contact Crosby today to get started.