Which statement best describes the purpose of a Data Processing Agreement (DPA)?

• A. It documents the financial terms and penalties for data processing vendors.
• B. It specifies the data processing activities, responsibilities, and compliance requirements when a processor handles personal data on behalf of a controller.
• C. It outlines the vendor's marketing commitments.
• D. It lists the hardware requirements for the processing environment.

Answer: (B)

DPAs set the contractual framework that ensures a processor handles personal data strictly according to the controller’s instructions and applicable data protection laws. The best description is that a DPA specifies what data will be processed, for what purposes, by whom, and for how long, while also outlining the processor’s responsibilities to protect that data. It requires appropriate security measures, defines obligations for handling subprocessors, enables cooperation on data subject rights, and details breach notification expectations and cross-border transfer rules. This coordination also covers how the processor must assist the controller in meeting compliance obligations and how disputes or audits will be handled. Terms about financial penalties, marketing commitments, or hardware requirements aren’t the core focus of a DPA, which is about the safe, compliant processing of personal data.