Data processing agreement (DPA)

Also written: DPA

The written contract between a controller and a processor. It limits what the processor may do, requires security, and requires the processor to name its subprocessors and get approval before adding new ones.