DPA vs Privacy Policy

The short answer

A data processing agreement (DPA) is a contract. It controls what a vendor may do with the personal data you give it. A privacy policy is a public notice that explains how the vendor uses data it collects for itself.

As a business customer, your data inside the product is covered by the DPA. The privacy policy often covers things like your staff's account details and website visits.

DPA

• What it is: a contract between you (the controller) and the vendor (the processor). GDPR Article 28(3) requires processing by a processor to be "governed by a contract or other legal act."
• Who it binds: you and the vendor. It often becomes part of your main agreement.
• Typical content: the vendor uses data only on your instructions, keeps it secure, lists its subprocessors, tells you about breaches, helps with data requests, and deletes or returns data at the end.

The Atlassian DPA is one example. It says Atlassian is a processor of Customer Data and promises notice "at least thirty (30) days before" a new subprocessor handles your personal data.

Privacy policy

• What it is: a public statement from the company to the people whose data it collects.
• Who it speaks to: individuals such as website visitors, account users and job applicants. Laws require it: under GDPR Article 13 a controller must tell people its purposes, legal basis, recipients and retention period, and the CCPA (section 1798.130(a)(5)) requires businesses to update their online privacy policy disclosures at least once every 12 months.
• Typical content: what data is collected, why, who it is shared with, how long it is kept, and people's rights.

Many SaaS privacy policies say they do not cover customer data. The Atlassian privacy policy, for example, says it "does not apply to the extent that we process personal information in the role of a processor."

Which one applies to you

Read both, for different reasons. They answer different questions about the same vendor, and a gap between them is worth spotting early.

• Your customer data in the product: look to the DPA. It is the document you can enforce against the vendor.
• Data the vendor collects for itself: look to the privacy policy. This includes your team's login details, usage analytics, sales calls and marketing tracking.
• Where they overlap: if the privacy policy says the vendor may use data for its own goals, such as AI training or ads, check whether that reaches your customer data. If the DPA does not allow it, ask the vendor in writing.

Both documents can change, and neither change needs your consent in many cases. A privacy policy is often updated by posting a new version. A DPA may also change without a new signature if it lives on the vendor's website and the agreement allows updates.

Example

Venpo flagged a DPA change where Retool's DPA now makes you check that your use of Retool meets privacy law. A change like this shifts work onto you as the customer, and it would not appear in the privacy policy at all.

On the privacy policy side, Venpo also caught a change where Perplexity moved three protections out of its privacy policy. That shows why the location of a promise matters: once it moves, you need to know which document now holds it, and whether that document binds the vendor to you.

How Venpo helps

Venpo monitors both your vendors' DPAs and their privacy policies, and emails a plain-English alert when either changes, with what changed and why it matters. The Fine Print Scan also answers whether each vendor trains AI on your data, how long it keeps data, and whether it sells data or uses it for ads.