An acronym for data processing agreement. A DPA is a written contract between a data controller and a data processor that it hires to process data it controls. If data is protected by the GDPR, then a DPA is required to hire the data processor.