Data Processing Agreement (DPA)
A specific, negotiated contract between a data controller (such as a lobbying firm) and a data processor (an AI vendor) governing how the vendor may handle data on the controller's behalf, including training restrictions, retention terms, and deletion rights. A signed DPA is enforceable in a way a standard clickthrough terms-of-service page is not.
Defined in 4 GAGE programs, which carry 5 distinct definitions of it. The wording above is taught in The AI Lobbyist: Certified AI Policy Strategist.
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
A specific, negotiated contract between a data controller (such as a lobbying firm) and a data processor (an AI vendor) governing how the vendor may handle data on the controller's behalf, including training restrictions, retention terms, and deletion rights. A signed DPA is enforceable in a way a standard clickthrough terms-of-service page is not.
A contract between a data controller and a data processor (or between a vendor and its enterprise customer) that sets terms for how personal data is handled, including, in many cases, retention periods that function as contractual retention obligations under Force 5 of Section 3C, independent of any statutory requirement.
A contract that governs how a vendor (including an AI provider) may process personal data on your organization's behalf. A genuine "enterprise" AI relationship is backed by a DPA (and a HIPAA Business Associate Agreement, or BAA, for protected health information); a personal paid subscription is not the same thing.
the contractual document, distinct from marketing material, stating what a vendor is actually permitted and obligated to do with a customer's data, including retention, use for product improvement, and deletion rights.
A written contract between an organization and a vendor specifying how the vendor may collect, use, retain, and protect the organization's data, the enforceable substitute this topic requires in place of a verbal assurance about a tool's data handling practices.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Online Safety, Privacy, and Data Basics · Digital Foundations, Certified AI Practitioner: Workplace Foundations
- Testing What You Did Not Build · Testing and Red-Teaming, Certified Agentic AI Governance Professional (CAAGP)
- The deletion decision: the terabytes your organization should destroy this quarter, defended · The Money of Data, Certified AI Data Governance Professional (CADGP)
- Client Confidentiality and Compliance When AI Touches the Work · AI for Lobbying Productivity, The AI Lobbyist: Certified AI Policy Strategist
- Protecting Client Intelligence: Information Security for Policy Campaigns · Defensive Operations, The AI Lobbyist: Certified AI Policy Strategist
Where it shows up at work
A definition is where Data Processing Agreement (DPA) starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Applies acceptable-use rules, discloses AI assistance where it matters, and keeps confidential material out of unapproved tools.
One lesson on this page teach it as a primary outcome.
Applies GDPR, CCPA and sector rules to training data, inference, automated decisions, lawful basis, individual rights and cross-border transfer.
One lesson on this page teach it as a primary outcome.
Tiers vendors by use and impact, requests evidence instead of promises, tests in the customer's context, and plans monitoring and exit.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- AI Literacy Leadneeds working knowledge
- Privacy Analystneeds working knowledge
- AI Vendor Risk Managerneeds it at depth
- Chief Privacy Officer, AI privacy editionneeds it at depth
- AI Regulatory Counselneeds it at depth · 14 open postings this week
- AI Adoption and Enablement Leadneeds working knowledge
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: EU AI Act Article 50; OECD AI Principles; GDPR; CCPA/CPRA.
One interview question about it
How do you decide what you may put into an AI tool at work, and how do you tell people when AI helped produce something?
Asked of candidates for responsible and disclosed use of ai at work. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Privacy and data protection carries it as work you can show: Privacy assessments and lawful-basis records are your work product.
- Legal and paralegal work carries it as a claim to back up: Privacy and consumer law are usually within reach.
- A law degree (JD, LLB or LLM), no AI work yet carries it as a claim to back up: Privacy and data protection law are usually a course, not yet a file.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.