A customer sends you their DPA: what to check before you sign
A data processing agreement lands in your inbox, drafted by the other side, with a request to sign by Friday. It looks like a formality. It is not. A DPA decides who carries the risk when data goes wrong, and signing someone else’s version unchecked is how that risk ends up on your side of the table.
A data processing agreement lands in your inbox, drafted by the other side, with a request to sign by Friday. It looks like a formality. It is not. A DPA decides who carries the risk when data goes wrong, and signing someone else’s version unchecked is how that risk ends up on your side of the table.
What is a data processing agreement?
A data processing agreement, or DPA, is a contract that governs how personal data is handled when one party processes it on behalf of another. Under the UK GDPR it is a legal requirement wherever a controller engages a processor. It sets out the scope of processing, the security expected, the use of sub processors, and what happens to the data at the end.
When do you need a DPA?
You need one whenever personal data is processed by one organisation on behalf of another. For a SaaS business that is constant: every customer whose data you handle, and every vendor that handles data for you, sits inside a controller and processor relationship that the law expects to be documented.
Why signing someone else’s DPA is risky
A customer’s DPA is drafted to protect the customer. That is reasonable, but it means obligations, liability and risk are weighted towards them by default. Signed without review, it can commit you to security measures you do not have, liability that is uncapped, or sub processor and audit terms you cannot realistically meet.
What to check before you sign
- Scope and instructions. Does the described processing match what you actually do, and are you only acting on documented instructions?
- Sub processors. Can you use your existing vendors, and are the approval and notice terms workable?
- International transfers. Where does data go, and are the right transfer mechanisms in place?
- Security measures. Are the required measures specific and ones you can genuinely meet?
- Liability and indemnity. Are your obligations capped, and is the risk allocation balanced?
- Audit and breach notification. Are audit rights and breach timelines realistic for your business?
- Deletion and return. What must happen to the data when the contract ends?
The California dimension
Recent amendments to the California Privacy Rights Act place stronger obligations on businesses handling Californian consumer data. If you sell into the US, or process data for customers who do, a DPA drafted only with UK and EU law in mind may leave gaps. “We are GDPR compliant” is no longer the whole answer.
The bottom line
A DPA is not a formality to clear before a deal closes. It is the document that decides who pays when there is a breach. Reviewing it properly, and negotiating the terms that do not work for you, is far cheaper than discovering the problem after the fact.
Frequently asked questions
What is a data processing agreement?
A data processing agreement (DPA) is a contract governing how personal data is handled when one party processes it on behalf of another. Under the UK GDPR it is required wherever a controller engages a processor, and it sets out the scope of processing, security, sub processors and what happens to the data at the end.
When do you need a DPA?
You need a DPA whenever personal data is processed by one organisation on behalf of another. For a SaaS business this is constant: every customer whose data you handle and every vendor that handles data for you sits in a controller and processor relationship the law expects to be documented.
What should you check before signing a customer’s DPA?
Check that the processing scope matches what you do, that sub processor and audit terms are workable, that international transfer mechanisms are in place, that the required security measures are ones you can meet, that your liability is capped, and that deletion and breach notification terms are realistic.
Do GDPR data processing agreements cover US data like California?
Not automatically. Recent California Privacy Rights Act amendments place stronger obligations on businesses handling Californian consumer data. A DPA drafted only for UK and EU law can leave gaps, so agreements with a US dimension need a fresh look.
Got a DPA waiting for signature?
Send it over. We review and negotiate data processing agreements for SaaS and tech businesses, UK, EU and US facing, so the terms protect you rather than just unblock the deal.
Book a call with us: calendly.com/dhruve-eligaconsultancy
Want updates like this first? Subscribe to Tech Counsel Insight, our newsletter for scaling SaaS and tech businesses.