# Data processing agreement

Concept · [Business and metrics](https://ecosystem.samcarlton.com/business)

Also called: DPA, data processing addendum, GDPR DPA

A contract that says how a service provider may handle [personal data](https://ecosystem.samcarlton.com/data-privacy) for its customer: what it may do with the data, how it keeps the data secure, which other companies it may pass the data to and what happens to the data when the contract ends. Customers with users in Europe usually ask for one, because the EU's [GDPR](https://ecosystem.samcarlton.com/compliance) requires it. [Common Paper](https://ecosystem.samcarlton.com/common-paper) publishes a free, standard template for this (Data Processing Agreement), built for GDPR.

**For example:** A European customer will sign only once a US startup also signs a DPA covering the [employee](https://ecosystem.samcarlton.com/contractor-vs-employee) records the customer will store in the product.

## Connects to (4)

- [Data privacy](https://ecosystem.samcarlton.com/data-privacy): How a company collects, uses, stores and shares information about people.
- [Compliance](https://ecosystem.samcarlton.com/compliance): Meeting the laws, regulations and standards that apply to a company.
- [Cloud service agreement](https://ecosystem.samcarlton.com/cloud-service-agreement): A contract between a company that sells cloud software and a business that buys it.
- [Common Paper](https://ecosystem.samcarlton.com/common-paper): A contract company for startups that publishes free, standard agreements anyone may use and modify, along with software for sending…

> This glossary is plain-language orientation, not legal or financial advice. Before you decide on a company structure, a contract, taxes or a fundraising deal, talk with a lawyer or an accountant.

Map view: https://ecosystem.samcarlton.com/data-processing-agreement