What is a data processing agreement?

Definition

A data processing agreement is a contract, or a section of one, that covers how a vendor handles your data: what it may do with it, security measures, sub-processors, breach notice, retention and deletion. Many SaaS vendors publish a standard DPA; larger customers sometimes negotiate.

It's where promises like "we don't train on your data" become enforceable.

Why it matters for advisors

For AI vendors, the DPA is where you confirm the things that matter most: no training on client data, a sub-processor list, deletion at termination, and breach notice to your firm within the 72 hours amended Regulation S-P asks firms to require of service providers.

If the DPA and the marketing page disagree, the DPA is what counts.

Read the DPA together with the vendor's terms of service and privacy policy, since they can conflict. If the terms say the vendor can use your data to improve its services and the DPA says it can't, ask which one controls and get the answer in writing.

Example

A firm's checklist requires every AI vendor's DPA to include a 72-hour breach notice, no model training on firm data, and deletion within a set number of days after termination.

Watch out for

Click-through terms can change. Save a copy of the version you agreed to.