DPA

What is a DPA?

A data processing agreement (DPA), in German "Auftragsverarbeitungsvertrag" (AVV), is a contract between a controller and a processor. The controller is the company that decides why and how personal data is processed. The processor is a service provider that processes personal data on the controller's behalf, such as a cloud or software provider.

Its legal basis is Article 28 of the GDPR. Among other things, the contract has to set out:

• the subject matter, duration, nature and purpose of the processing
• the types of personal data and the categories of data subjects
• that the processor acts only on documented instructions and binds its staff to confidentiality
• the technical and organisational measures (Art. 32 GDPR)
• the conditions for engaging further sub-processors
• help with data subject rights, deletion or return of data at the end, and evidence and audits

Whether a DPA is needed, and in what form, depends on the specific use. This entry is not legal advice; if in doubt, check with your data protection officer or legal counsel.

DPAs at Openbase.one

A DPA with Openbase.one is available on request. Platform data is hosted in Frankfurt. AI model calls go through commercial providers (OpenRouter; in EU mode AWS Bedrock in eu-central-1), so look at that part separately in your review. Data is exportable, and the audit log shows who changed what.