Digital and data

Data processing agreement (DPA)

The contract required by Article 28 GDPR between a controller and a processor, setting out what the processor may do with personal data.

What Data processing agreement (DPA) means

Whenever a business lets a service provider process personal data on its behalf, GDPR requires a written contract. The data processing agreement defines the subject matter, duration, nature and purpose of the processing, the types of data and categories of individuals, and the obligations of the processor: to act only on documented instructions, to keep the data confidential and secure, to assist with data subject requests and breach notifications, to delete or return the data at the end and to allow audits.

The agreement also governs sub-processors: the processor may engage them only with the controller's general or specific authorisation and must flow down the same obligations. For accounting software the user is the controller of the data in its documents and the software provider is the processor. Kontevia's DPA forms part of its terms and lists the sub-processors involved in providing the service.

Related terms

GDPR (General Data Protection Regulation)The EU regulation on personal data that applies to every business processing data of individuals, including the names and contact details on invoices.Sub-processorA third party that a processor uses to carry out part of the processing, such as hosting, e-mail delivery or document extraction. Must be disclosed to the controller.Archive retentionThe legal duty to keep invoices and accounting records for a set number of years in a readable, authentic and unaltered form.

This entry is general information, not tax advice. Rules change; check the current position with your adviser or the tax authority of your country.

Back to the full glossary

Kontevia applies these rules for you

Rates, thresholds and e-invoicing formats come from the jurisdiction data of your country. You send the document, Kontevia books it and keeps the VAT summary ready.

Start in early access