What is a data processing agreement?

A data processing agreement (DPA) is a contract between you and your client that governs how you handle their personal data. If your freelance work involves accessing, processing, or storing personal information on behalf of a client - think customer lists, user databases, or CRM data - you need one.

When should you use one?

When your work involves handling personal data belonging to your client's customers or employees. Common scenarios include email marketing, CRM management, web analytics, database administration, or any work that gives you access to personally identifiable information.

What's included

Data being processed - the types of personal data you'll access (names, emails, addresses, payment info, etc.) and whose data it is.

Purpose and scope - exactly what you'll do with the data and why. Processing must be limited to what's necessary for the work.

Security measures - how you'll protect the data. Covers encryption, access controls, secure storage, and device security.

Sub-processors - any third-party tools you use that will also handle the data (e.g. email platforms, analytics tools).

Breach notification - what happens if there's a data breach. Includes notification timelines and response procedures.

Data return and deletion - what happens to the data when the project ends.