For workplace software the DPA is standard procurement paperwork: booking, attendance and visitor records are personal data, so the vendor processes on your behalf. A vendor who cannot produce a clean DPA and a current sub-processor list quickly is telling you something.
Common questions
What does Data Processing Agreement (DPA) mean in simple terms?+
A data processing agreement, or DPA, is the contract between a data controller (you) and a processor (your vendor) setting out what personal data is processed, why, how it is protected, which sub-processors may touch it and what happens on breach or termination. GDPR makes one mandatory whenever a processor handles personal data for you.
How is Data Processing Agreement (DPA) measured and reported?+
For workplace software the DPA is standard procurement paperwork: booking, attendance and visitor records are personal data, so the vendor processes on your behalf. A vendor who cannot produce a clean DPA and a current sub-processor list quickly is telling you something.