Start for free Start for free

Customer DPA Request

A customer DPA request is when a customer asks you to sign a data processing agreement, the contract that sets out how you, as their vendor, handle the personal data they share with you and which subprocessors you use.

What is a customer DPA request?

A customer DPA request is when one of your customers asks you to sign a data processing agreement (DPA). A DPA is the contract that sets out how you handle the personal data the customer gives you.

In that relationship your customer is usually the data controller: it decides why and how the data is used. You are the data processor: you handle the data on its behalf (GDPR Article 4). GDPR Article 28 requires a written contract between the two, which is why customers who handle EU personal data ask for one.

The request may come with the customer's own DPA template, or the customer may ask for yours.

Why it matters to you

A DPA is mostly about what you promise, and many of those promises depend on your own vendors. Article 28 requires the contract to cover, among other things:

  • Using other processors only with the customer's authorization, and telling the customer about changes so it can object.
  • Helping the customer answer people's requests to access or delete their data.
  • Giving the customer the information it needs to check compliance, and allowing audits.
  • Passing the same data protection duties down to each subprocessor, while staying fully liable for them.

You cannot honestly sign those promises without knowing who your subprocessors are, what each one does with the data, and where. If your email provider or AI model vendor changes its terms after you sign, your DPA may stop matching reality.

A DPA request often arrives in the middle of a sale. A clear, ready answer keeps the deal moving.

What to check

  • Have a current subprocessor list ready: names, purpose, data types and locations.
  • Read the DPAs your own key vendors gave you. Any promise you make on breach notice, data location or deletion should not exceed theirs. See back-to-back terms.
  • Check the subprocessor notice period the customer asks for, and confirm you can meet it given how your vendors notify you.
  • Look for audit clauses that go beyond a SOC 2 report or similar document. On-site audits cost time.
  • Check whether any vendor trains AI on customer data or keeps it longer than you promise. The customer may ask.

How Venpo helps

Venpo tracks the DPAs, privacy policies and subprocessor lists of your vendors and emails you when one changes. Its Fine Print Scan also answers whether each vendor trains AI on your data and how long it keeps data, two questions customers often raise in a DPA review.

Start for free

Frequently asked questions

Do I have to sign a customer's DPA?

If you process EU personal data for a customer, GDPR Article 28 requires a written contract that covers set topics. You can usually offer your own DPA instead of the customer's template, as long as it covers those topics.

Should I use my own DPA or the customer's?

Your own DPA is faster to sign because you already know you can meet it. A customer template may include promises your vendors do not back up, so read it against your vendor contracts first.

Related terms

Vendor Documents Data Processing Agreement (DPA) A data processing agreement (DPA) is a contract that sets the rules for how a vendor handles personal data on your behalf, including security, subprocessors, breach notice and deletion. The GDPR requires one whenever it applies. Subprocessors and DPAs GDPR Article 28 GDPR Article 28 is the EU privacy law rule that says what must be in the contract between a business and a vendor that handles personal data for it. That contract is usually called a data processing agreement, or DPA. Your Obligations to Your Customers How to Publish Your Own Subprocessor List Publishing your own subprocessor list means posting a public page that names every outside company that handles your customers' personal data, what each one does and where, and keeping it current as your vendors change. Your Obligations to Your Customers Back-to-Back Terms Back-to-back terms means the promises you make to your customers are backed by matching promises from your vendors, so you never commit to more (faster notice, higher uptime, wider liability) than your own vendors commit to you. Comparisons Controller vs Processor Under GDPR, a controller decides why and how personal data is used, while a processor handles that data on the controller's behalf and follows its instructions. When you use a SaaS tool for your customers' data, you are usually the controller and the vendor is the processor.

Sources

Last reviewed