What is a data processing agreement and do I need one?

A data processing agreement sits alongside your main contract. In SaaS, the customer decides why personal information is processed, and the vendor processes it to provide the service.

Why do customers ask for one?

Because the law keeps them responsible. Under Principle 4.1.3 of PIPEDA’s Schedule 1, an organization is responsible for personal information it transfers to a third party for processing, and must use contractual or other means to provide a comparable level of protection. A DPA is that contract. Quebec’s private sector law (section 18.3) requires the mandate or service contract to be in writing when information is communicated to a service provider, and Article 28 of the GDPR lists specific terms that must be in a processor contract.

What should a DPA cover?

Term	What it says
Scope and instructions	The vendor processes the data only to provide the service and on the customer’s instructions
Confidentiality	Staff with access are bound to confidentiality
Security	The vendor’s technical and organizational measures, often in a schedule
Sub-processors	A list of sub-processors, notice of changes, and a right to object
Location and transfers	Where data is stored and processed, and how cross-border transfers are handled
Breach notice	How quickly the vendor will notify the customer, and what information it will give
Assistance	Help with access requests, impact assessments and regulator inquiries
Return and deletion	What happens to the data at the end of the contract
Audit	How the customer can verify compliance, often through reports instead of on-site audits

Do I need one with my own vendors?

Yes, for vendors that handle personal information for you, such as hosting, email, analytics, support tools and AI providers. Most large vendors offer a standard DPA you accept online; keep a copy and check that it covers what you’ve promised your own customers.

Should I use my DPA or the customer’s?

Use your own if you can. A standard DPA you’ve prepared in advance, with a published sub-processor list, speeds up procurement and keeps your obligations consistent across customers. Enterprise customers will still sometimes insist on theirs; review the breach notice window, audit rights, liability and AI training terms closely.

How does it connect to the liability cap?

Customers often ask for uncapped or higher liability for data protection breaches. Decide your position on a separate cap for data claims in your SaaS agreement. See limitation of liability clauses.

What about AI features?

Say clearly whether customer data is used to train or improve models, and list AI providers as sub-processors. See can your SaaS use customer data to train its AI models.

What to do next

Prepare a DPA and a sub-processor list before your first enterprise deal asks for them. Data processing terms can be added to a SaaS or master services agreement, and we review customers’ DPAs as a contract review. Fees are on our fees page.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To talk through a DPA request, book a free 15-minute consult.