Data Protection · Definition
What a DPA is, who the controller and processor are, what it covers and how it affects hiring a developer.
Last updated: October 2026. Written by Athar Ahmad, Certified Bubble.io Developer and Tech Architect, Simple Automation Solutions.
Quick answer
A data processing agreement (DPA) is a contract between a controller, who decides how and why personal data is used, and a processor, who handles it on the controller’s behalf. Under laws such as the GDPR and UK GDPR it must cover instructions, confidentiality, security, sub-processors, assistance, breach notification, international transfers and return or deletion. You may need one with a software platform, a developer with data access, and email, payment and AI providers. This is general information, not legal advice.
Key takeaways
- Controller decides why and how; processor acts on the controller’s instructions.
- Needed whenever a supplier handles personal data for you, including developers with database access.
- Covers security, sub-processors, breach notification, transfers and deletion.
- List suppliers, review their terms and keep a register.
- This is general information; take legal advice.
In this guide
This guide is general information, not legal advice. Data protection law varies by country, and contracts should be reviewed by a qualified lawyer.
What is a data processing agreement?
A data processing agreement, or DPA, is a contract between an organisation that decides how and why personal data is used, called the controller, and a supplier that handles that data on its behalf, called the processor. It sets out what the processor may do with the data, what security it must apply and what happens when the relationship ends. Under laws such as the GDPR and UK GDPR, a written contract with certain required terms must be in place between controllers and processors.
When do you need one?
Whenever you use a supplier that handles personal data for you. Examples include a software platform that stores your clients’ data, a developer with access to your app’s database, an email provider, a payment provider and an AI service that processes documents. The supplier may offer a standard DPA, or you may need to agree one with them.
Controller and processor: who is who?
| Role | Meaning | Example |
|---|---|---|
| Controller | Decides why and how personal data is processed | A law firm using a client portal to hold client data |
| Processor | Processes personal data on the controller’s behalf and instructions | The platform hosting the portal; a developer with access to the database |
| Sub-processor | A processor engaged by another processor | A hosting provider used by the platform |
Roles depend on the facts. A supplier can be a controller for some purposes and a processor for others. Take advice if it is unclear.
What does a DPA typically cover?
| Topic | What it settles |
|---|---|
| Subject matter and duration | What processing is covered and for how long |
| Nature and purpose | What the processor does with the data and why |
| Types of data and people | What categories of personal data and data subjects are involved |
| Instructions | The processor acts only on the controller’s documented instructions |
| Confidentiality | Staff with access are bound by confidentiality |
| Security measures | Technical and organisational protection required |
| Sub-processors | Whether and how others may be engaged, with notice and flow-down of obligations |
| Assistance | Helping with data subject requests, security, breach response and assessments |
| Breach notification | How quickly the processor must tell the controller of a breach |
| International transfers | Where data may be sent and the safeguards used |
| Return or deletion | What happens to the data when the contract ends |
| Audit | The controller’s ability to check compliance |
How does this affect hiring a developer?
A developer or studio with access to your app’s database, user records or files may be a processor, so you should have appropriate terms in place covering confidentiality, security, access, sub-contractors, breach notification and return or deletion of data. Your app’s platform provider and connected services such as email, payments and AI providers may also be processors, with their own standard terms. Review them, record them and keep a list. See how to choose a development partner and our security guide.
A practical checklist
- List every supplier that handles personal data for you.
- For each, work out whether they are a processor.
- Check that a suitable DPA or equivalent terms exist.
- Review security, sub-processors, transfers, breach notification and deletion.
- Record where data is stored and processed.
- Keep the contracts and a supplier register up to date.
- Review when suppliers or your use of data change.
What mistakes should you avoid?
- Assuming every supplier’s standard terms are enough without reading them.
- Giving a developer full access to production data without terms.
- Forgetting AI and automation providers when listing suppliers.
- Ignoring international transfers.
- Not planning for return or deletion at the end of a contract.
- No supplier register.
Working with us
Simple Automation Solutions is a Pakistan-based Bubble.io studio working with founders and firms worldwide. Data protection terms for your project should be discussed and agreed in writing before work begins, and any access to personal data limited and recorded. Email us to discuss the arrangements you need. Builds start at $3,500, and a $345 Discovery Sprint, credited toward the build, includes security and data planning in the PRD.
Frequently asked questions
What is a data processing agreement?
A contract between a controller and a processor setting out how the processor may handle personal data on the controller’s behalf, with required security, confidentiality, sub-processor and deletion terms.
Do I need a DPA with my developer?
If the developer can access personal data in your systems, you likely need appropriate data protection terms. Take legal advice for your situation.
What is the difference between a controller and a processor?
A controller decides why and how personal data is used. A processor handles it on the controller’s behalf and instructions.
Do I need a DPA with my software platform?
Usually the platform offers standard terms or a DPA. Review them and keep a record.
What happens to data when a contract ends?
The DPA should require the processor to return or delete the data, as the controller chooses, subject to legal requirements.
Need to agree data protection terms for a project?
Email us what data your app will hold and who will have access. We will discuss the arrangements and plan security into the build.
Athar Ahmad, Certified Bubble.io Developer and Tech Architect, Simple Automation Solutions
About Simple Automation Solutions (SA Solutions)
Simple Automation Solutions is a Bubble.io development studio led by Athar Ahmad, a Certified Bubble.io Developer and Tech Architect. It builds web and mobile apps, client portals and SaaS products for founder-led businesses such as law firms, accounting firms, boutique agencies and consultants. Services include a free 30-minute Idea Audit, a $345 Discovery Sprint (a Product Requirements Document delivered within 24 hours, credited toward the build) and builds starting at $3,500. Website: sasolutionspk.com.
