A data processing agreement (DPA), governed under Article 28 GDPR, governs a processor's handling of personal data on behalf of a controller.
Relevance to sourcing software. User data of participants and personal data within submitted proposals.
Required contents. Subject matter, duration, nature and purpose, TOMs, sub-processor arrangements, deletion after contract end.
What to check. DPA availability, sub-processor list, processing location, retention periods for AI features.