What is a data processing agreement?

A data processing agreement, often called a DPA, is a contract between a business that controls personal information and a service provider that processes that personal information on the business’s behalf. A data processing agreement governs how the service provider may collect, use, store, transfer, and dispose of personal information; what security safeguards must be in place; what happens in the event of a data breach; and what rights the business has to audit, instruct, and terminate the service provider. Data processing agreements are used across almost every industry and have become a standard part of entering transactions.

Why you should consider a data processing agreement

Allocating privacy responsibilities between business and vendor. A data processing agreement sets out which party is responsible for which privacy obligations — including consent, retention, data subject requests, breach notification, and security safeguards. Without a data processing agreement, the allocation of privacy responsibilities is unclear, and the business can be left exposed to regulatory and contractual risk for actions taken by its vendors.

Documenting compliance with Canadian privacy legislation. Canadian privacy legislation, including PIPEDA and Alberta’s PIPA, requires businesses to use contractual or other means to ensure that personal information transferred to third-party processors receives a comparable level of protection. A data processing agreement is the most common way to document that contractual protection, and is generally expected by privacy regulators in any review of a business’s privacy practices.

Preparing for international and cross-border data transfers. A data processing agreement is essential where personal information is transferred to vendors outside of Canada — including the United States, the European Union, the United Kingdom, and other jurisdictions. A data processing agreement can incorporate standard contractual clauses, transfer impact assessments, and other mechanisms required by foreign privacy regimes such as the GDPR, and can document the cross-border safeguards expected under Canadian privacy law.

Managing data breach risk and notification obligations. A data processing agreement allocates responsibility for detecting, investigating, and reporting data breaches. PIPEDA requires organizations to notify affected individuals and the Privacy Commissioner of Canada of breaches that pose a real risk of significant harm, and a data processing agreement supports compliance by requiring vendors to report breaches promptly, cooperate in the investigation, and bear specified costs of notification and remediation.

Protecting confidential information and brand reputation. A data processing agreement protects not only personal information but also confidential information and data more broadly. A vendor that handles customer data, business records, and proprietary information can do significant damage to a business’s reputation through a privacy or security incident, and a data processing agreement is an important tool for managing that risk.

Relevant laws and regulations

Personal Information Protection and Electronic Documents Act, SC 2000, c 5. Canada’s federal private-sector privacy legislation, which governs the collection, use, and disclosure of personal information in the course of commercial activities and which sets out the framework that a data processing agreement is generally drafted to support.

Personal Information Protection Act, SA 2003, c P-6.5. Alberta’s private-sector privacy legislation, which applies to organizations operating in Alberta and which imposes obligations on the use of service providers and third-party processors that a data processing agreement is generally drafted to address.

Canada’s Anti-Spam Legislation, SC 2010, c 23. Canada’s federal anti-spam legislation, which governs commercial electronic messages and can intersect with a data processing agreement where the vendor handles email, SMS, or other electronic marketing channels on behalf of the business.

Common legal issues

Scope and purpose of processing. The most common issue in a data processing agreement is unclear definition of what personal information is being processed, for what purposes, and within what limits. A data processing agreement should identify the categories of personal information, the categories of data subjects, the processing activities permitted, and the limits on use for the vendor’s own purposes. Vagueness on scope and purpose is a leading source of disputes and regulatory exposure.

Sub-processors and onward transfers. Most vendors rely on their own sub-processors — cloud hosts, payment networks, analytics providers — to deliver their services. A data processing agreement needs to address whether sub-processors are permitted, what notice and consent requirements apply, and whether the primary vendor remains liable for the acts of its sub-processors. Silence on sub-processors can leave personal information being passed through chains of vendors without contractual protection.

Security safeguards and standards. A data processing agreement generally requires the vendor to maintain specified security safeguards. Issues arise where the safeguards are described too generically to be enforceable, where they are tied to standards that the vendor does not actually meet, or where they do not reflect the sensitivity of the personal information involved.

Cross-border transfers and data residency. A data processing agreement involving cross-border data transfers needs to address the legal frameworks of the destination jurisdictions, the contractual safeguards required, and any data residency commitments. Canadian privacy regulators have expressed expectations around transparency and accountability for cross-border transfers, and certain industries and government contracts impose specific data residency requirements that a data processing agreement must reflect.

Termination, return, and deletion of data. A data processing agreement needs to address what happens to personal information when the underlying commercial relationship ends — whether the vendor returns the data, deletes it, retains it for a transition period, or keeps backups. Inconsistent or unclear termination provisions can leave personal information in vendor systems indefinitely, contrary to retention requirements under privacy legislation.

Frequently asked questions

Is a data processing agreement legally required in Canada? Canadian privacy legislation does not specifically require a written data processing agreement, but PIPEDA and PIPA both require organizations to use contractual or other means to ensure comparable protection of personal information transferred to third-party processors. A data processing agreement is the most common and most defensible way to meet that requirement.

What is the difference between a data processing agreement and a privacy policy? A privacy policy is a public-facing document that informs individuals about how a business handles their personal information. A data processing agreement is a private contract between a business and a service provider to govern the processing of data. The two documents serve different purposes and operate at different layers of the privacy framework.

Does a Canadian business need a data processing agreement with a US vendor? A data processing agreement is generally advisable for any vendor relationship involving personal information, including with US-based vendors. Cross-border transfers raise additional issues including transparency obligations, foreign government access concerns, and potential application of the GDPR or other foreign regimes, all of which a data processing agreement is generally drafted to address.

What happens if a vendor breaches a data processing agreement? A breach of a data processing agreement can give rise to contractual claims by the business and can also trigger regulatory consequences if the breach involves a contravention of PIPEDA, PIPA, or CASL. A data processing agreement generally specifies remedies available to the business, including audit rights, injunctive relief, and specified cost recovery for breach response.