Glossary: Data Processing Agreement

A Data Processing Agreement (DPA) is a legal contract between a company and a vendor that defines how the vendor may process personal data on the company’s behalf, as required under regulations like GDPR. It sets out responsibilities, security obligations, and data handling terms.

Examples

• A company signs a DPA with its analytics provider before sending it any user data.

• A DPA specifies that a vendor must delete user data within a set period after a contract ends.

• An enterprise customer requests a signed DPA as part of its vendor security review.

DPAs and crypto analytics

Crypto teams often assume onchain data is public and therefore outside privacy law. A wallet address on its own is pseudonymous, but under frameworks such as GDPR it may count as personal data once it can be linked to a person, for example through a form, an email or browsing data. An analytics vendor that receives wallet addresses together with browsing data usually acts as a processor, so a DPA belongs in the vendor review.

Example

A DeFi frontend that serves EU users adds a web analytics SDK. Before launch, its legal team reviews the vendor’s DPA, checks the sub-processor list, confirms what personal data the SDK collects, and records the vendor in its processing register.

Formo’s DPA

Formo publishes its Data Processing Addendum at formo.so/dpa, with its sub-processors listed in an annex. Formo also keeps the data it processes small: the server uses the IP address only in memory, to compute a daily session hash and the visitor’s country, and never stores it. Formo does not set third-party cookies or use device fingerprinting, and it stores country only, never region or city.

Related reading

Explore PII (Personally Identifiable Information), Server-side Tracking, and Data Collection.

FAQs

When is a DPA required?

Under GDPR, a controller must use a contract that meets Article 28 when a processor handles personal data on the controller’s behalf. Other laws and roles may impose different requirements; assess the actual processing relationship and applicable rules.

What does a DPA typically cover?

Data handling responsibilities, security measures, sub-processor terms, breach notification, and data deletion obligations.

Does signing a DPA alone make processing compliant?

No. A DPA documents responsibilities between parties, but compliance also depends on the lawful basis, notices, security, data minimization, retention, transfers, and the parties’ actual practices.

Does Formo offer a DPA?

Yes. Formo’s Data Processing Addendum is published at formo.so/dpa and lists its sub-processors. Formo does not store IP addresses, set third-party cookies or use device fingerprinting.