Glossary/Privacy and identity/Data processing agreement (DPA)
What is a DPA (data processing agreement) under GDPR?
What a data processing agreement is, what GDPR requires it to include, and when publishers need one with data partners and advertisers.
Written by Samhub with the help of AI·Updated 13 Oct 2026·3 min readA data processing agreement (DPA) is the contract GDPR requires when one company (the processor) handles personal data on behalf of another (the controller). It is set out in GDPR article 28.
What a DPA must include
Subject and duration
What data is processed, about whom, and for how long.
Instructions
The processor acts only on the controller’s documented instructions.
Security
The technical and organizational measures that protect the data.
Sub-processors
Who else may handle the data, and on what terms.
Help and deletion
Support with readers’ rights, and deletion or return of data at the end.
When publishers need a DPA
16 pages for publishers, with a checklist for data, programmatic and direct sales.
Fewer vendors, fewer DPAs
A typical media data setup uses 16 providers, and each one needs its own agreement and review. Collecting data in one EU-based platform cuts the number of contracts and the risk that comes with them.
Addressability at Stampen Media after moving its reader data into one layer with Samhub.
Frequently asked questions
Yes, whenever a processor handles personal data for a controller under GDPR.
The controller decides why and how data is used. The processor handles it on the controller’s instructions.
Yes. It can be a section of the contract or a separate document, as long as it covers what article 28 requires.
Only if they process personal data on your behalf. Sharing ID-free audiences usually does not make them your processor.
Related terms
Any information that relates to an identifiable person.
Replacing direct identifiers so data cannot be linked to a person on its own.
The industry standard for passing consent to ad tech vendors.
Collects and stores readers’ consent choices.
One EU-based platform to collect, unify and enrich your first-party data, installed with one script.
- A walkthrough with your own data
- Built for publishers and media houses
- 30 minutes, no commitment
Turn your audience data into more revenue
Get the Media Monetization Playbook: how media houses turn first-party data into higher CPMs, data deals and direct sales. With checklists for every step.
