Data processing agreement
By Gareth HoyleLast updated How we research
A data processing agreement is the contract that limits how a vendor may handle personal data on another company's behalf, such as a CCPA service provider contract.
A data processing agreement is a contract that limits how a vendor may use personal data it handles on behalf of another company. In the US the closest statutory forms are the written contract the CCPA requires with a service provider or contractor, under California Civil Code section 1798.140(ag) and (j), and the HIPAA business associate agreement.
What must a US service provider contract include?
A CCPA service provider contract must prohibit the vendor from selling or sharing the personal information, and from retaining, using or disclosing it outside the business purposes in the contract. A business associate contract, as HHS describes it, must set the permitted uses of protected health information, require safeguards and require return or destruction of the data at termination where feasible.
If you hold UK data, Article 28 of UK GDPR requires a similar written contract between a controller and a processor, with minimum terms set out in the ICO's guidance.
Is a data processing agreement enough for an AI data license?
A data processing agreement is usually not the right contract for an AI data license. A buyer training its own models uses the data for its own purposes, not on your behalf, and a transfer of personal information for value can be a sale under the CCPA. The commercial terms belong in a data license. Your existing vendor and client agreements may also restrict what you can license.
See the licensing agreement checklist and lawful basis for UK and EU data.