In a data processing agreement for cross-border transfers, which roles are typically defined?

• A. Service provider and vendor manager only.
• B. Data owner and data custodian roles not used in DPAs.
• C. IT support and facilities manager.
• D. Data controller and data processor roles.

Answer: (D)

In cross-border data transfers, a data processing agreement defines the parties by their data roles. The data controller determines the purposes and means of processing and is responsible for ensuring the transfer complies with applicable laws. The data processor processes personal data on behalf of the controller, following its instructions and implementing appropriate security and privacy measures. This arrangement clarifies who makes decisions about processing, who is responsible for compliance, and who bears liability, which is essential for lawful international transfers. Other internal or governance terms like IT support, facilities manager, data owner, or data custodian describe operational roles or internal stewardship and do not establish the contractual processing relationship that DPAs formalize.