What is a data processing agreement (DPA)?
Quick answer
A data processing agreement, or DPA, is a contract, often an addendum to a vendor's main terms, that sets out how a vendor may handle personal data it processes on your behalf: what it can do with the data, how it protects it, who else touches it and what happens to it when the service ends.
Last updated
Updated · By Robert Breen
Why it matters for a small business
Most business tools hold personal data: names and emails in a form tool, client files in a portal, transcripts in an AI note taker. When a vendor processes that data for you, you are still responsible for it. A DPA puts the vendor's promises in writing, so you are not relying on a marketing page.
Under the EU's GDPR, a business that decides why and how personal data is used (the controller) must have a written contract with a vendor that processes it on its behalf (the processor), and the law lists topics that contract has to cover. Some US state privacy laws also require specific contract terms with service providers. Whether a given law applies to your business, and whether a vendor's standard DPA is enough, are questions for an attorney or privacy professional. What you can do is know the document exists and ask for it.
In a real lesson: Build an AI Demo Request Form That Qualifies Leads
In the AI Demo Request Form lesson, you build a Book a Demo page in Lovable for Northwind Scheduling Software, a made-up software company. Prospects type their Name, Email, What do you need help with? and Team size, and the form sends that to an n8n webhook.
Follow one submission. It passes through Lovable, then n8n, then an AI model that rates the lead Hot, Warm or Nurture, then a Google Sheet called Leads, then Gmail for the reply. That is personal data handled by several vendors on Northwind's behalf. In a real company, each of those vendors would be a reason to check the terms, and many publish a DPA you can review or accept.
The lesson itself is about building the form and the workflow, and its practice copy sends nothing anywhere. It does not discuss contracts. The point here is the habit: before real customer data flows through a new tool, find out what the vendor's DPA says and who at your company approves it.
Try this lesson free or read the step-by-step guide.
Common confusions
DPA vs privacy policy
A privacy policy is a public notice that tells people how a company uses their data. A DPA is a contract between you and a vendor about data the vendor handles for you. A good privacy policy does not replace a DPA.
DPA vs SOC 2 report
A DPA is a set of promises. A SOC 2 report is an independent auditor's description of whether a vendor's controls are in place. Many companies review both before approving a vendor.
Tips
- Look for the vendor's list of subprocessors, the other companies that touch your data, and how you will hear about changes.
- Check what happens to your data when you cancel: returned, deleted, or kept, and for how long.
- Send only the fields a workflow needs. Data you never collect needs no agreement.
- Have your attorney or privacy lead review the DPA before anyone signs or clicks accept.
Related terms
More Business terms
Where you use it: free lessons
- Build an AI Demo Request Form That Qualifies Leads (Lovable and n8n, 15 min)
- Build an n8n AI Agent That Writes Deal Follow-Ups (n8n, 12 min)
Frequently asked questions
- Do I need a DPA with every AI tool?
- If the tool will process personal data for your business, it is worth checking whether the vendor offers one and whether your situation requires one. Many business plans include a DPA. An attorney can tell you what the laws that apply to you require.
- Can I write my own DPA?
- Large customers sometimes do, but most small businesses accept or negotiate the vendor's version. Either way, have a qualified professional review it rather than relying on a template or an AI draft.