Data processing agreement (DPA)
Governs how a vendor handles personal data
A contract required whenever a vendor processes personal data on a business's behalf, setting out what the vendor can do with that data, security obligations, and what happens in a breach. Under Canadian privacy law (PIPEDA), a business remains responsible for personal data even after handing it to a third party, so a DPA is how that responsibility gets allocated in writing.
Ruby drafts this
Flat-fee, lawyer-reviewed, ready when you need it.
Have a question this glossary can't answer?
Tell us about your matter and a Ruby lawyer will follow up directly.