A Data Processing Agreement (DPA) — also called a Data Processing Addendum — is the GDPR Article 28 contract between a data controller and a data processor handling personal data on its behalf. Article 28(3) requires the processor to act only on documented instructions, apply Article 32 security measures, assist with data subject rights and breach notifications, delete or return data at the end of the contract, and use sub-processors only with permission. Where processing involves international transfers, the DPA typically includes Standard Contractual Clauses (SCCs). Note: "DPA" also stands for Data Protection Authority — different concept, same acronym.