Data Processing Agreement (DPA)
A contract between a data controller and a data processor (or between a vendor and its enterprise customer) that sets terms for how personal data is handled, including, in many cases, retention periods that function as contractual retention obligations under Force 5 of Section 3C, independent of any statutory requirement.
Defined in 4 GAGE programs, which carry 4 distinct definitions of it. The wording above is taught in AI Data Governance: The Data Chair.
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
A specific, negotiated contract between a data controller (such as a lobbying firm) and a data processor (an AI vendor) governing how the vendor may handle data on the controller's behalf, including training restrictions, retention terms, and deletion rights. A signed DPA is enforceable in a way a standard clickthrough terms-of-service page is not.
A contract between a data controller and a data processor (or between a vendor and its enterprise customer) that sets terms for how personal data is handled, including, in many cases, retention periods that function as contractual retention obligations under Force 5 of Section 3C, independent of any statutory requirement.
A contract that governs how a vendor (including an AI provider) may process personal data on your organization's behalf. A genuine "enterprise" AI relationship is backed by a DPA (and a HIPAA Business Associate Agreement, or BAA, for protected health information); a personal paid subscription is not the same thing.
the contractual document, distinct from marketing material, stating what a vendor is actually permitted and obligated to do with a customer's data, including retention, use for product improvement, and deletion rights.
Where it is taught
The exact lessons this term appears in. The first 7 topics of every program are free with a free account.
- Online Safety, Privacy, and Data Basics · Digital Foundations, AI Literacy & Professional Conduct
- Testing What You Did Not Build · Testing and Red-Teaming, Agentic AI Governance: Applied Mastery
- The deletion decision: the terabytes your organization should destroy this quarter, defended · The Money of Data, AI Data Governance: The Data Chair
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.