What Is a Data Processing Agreement (DPA)? A Plain-English Guide for Data Sellers
By Andrew Smart, founder of MON$TER · About
A data processing agreement (DPA) is a contract that sets the rules when one company handles personal data on behalf of another: what the data can be used for, how it is protected, who else can touch it, and what happens when the relationship ends. Privacy laws such as the EU's GDPR require one in many situations.
Why DPAs matter before you license data
If your business sells software or services, you may already have signed DPAs with your customers. Those agreements often limit what you can do with data that came from them. Before you license anything to an AI buyer, check whether your DPAs and customer terms allow the use you have in mind — and whether properly anonymized or aggregated data falls outside them. This is general information, not legal advice; your own counsel should confirm.
Does a data licensing deal need a DPA?
It depends on what is shared. Reputable AI buyers generally want anonymized, no-PII datasets, and data that truly can't identify anyone is usually treated differently from personal data. If any personal data would change hands, expect privacy terms such as a DPA to be part of the deal. See what counts as PII and is it legal to sell business data to AI?
DPA vs. data license
- DPA: protects personal data that one company processes for another.
- Data license: grants a buyer the right to use your data on set terms, in exchange for payment. See the key terms in a data licensing agreement.
More definitions in the glossary. Ready to see what your data could be worth? Start at Business Data.