What Is a DPA and Why Clients Ask

A longtime client emails you asking for a Data Processing Agreement before sharing their tax documents. If you have never seen one before, it can feel like a legal trap. It is not -- but it is a real obligation in certain situations. Here is what it means, when it matters, and what to look for before you sign.

What Is a Data Processing Agreement?

A Data Processing Agreement (DPA) is a written contract between a data controller (your client) and a data processor (you) that specifies how personal data is used, stored, and protected. It became standard practice after the EU's GDPR took effect in 2018 and is now common across regulated US industries as well.

Under Article 28 of the GDPR, any organization in the EU (or any company that handles data about EU residents) must have a DPA in place with every third party that processes that data on their behalf. That is why European clients, and US firms with EU-based customers, are sending these requests. The DPA documents what you do with the data and what steps you would take if something went wrong.

When Do Clients Ask for a DPA?

Clients typically ask when EU data regulations apply to them, when their industry is subject to a US privacy law with similar requirements, or when their legal team runs a standard vendor-compliance check. It is most common with accounting firms, agencies, and law firms that work with EU-based clients or handle regulated financial data.

• EU and UK clients, or US companies with EU customers: GDPR and UK GDPR both require a DPA with every third-party processor.
• US financial firms, including tax preparers: the Gramm-Leach-Bliley Act Safeguards Rule requires written agreements with any service provider that handles customer financial data.
• Healthcare-adjacent clients: HIPAA uses the term Business Associate Agreement (BAA) rather than DPA, but the contractual structure is the same.
• Large enterprise clients: many run vendor-compliance checklists that include a DPA by default, regardless of regulation.

What a DPA Typically Covers

A standard DPA, whether drafted under GDPR, a US state framework, or a client's internal policy, usually addresses:

• The scope of data being processed: what data, for what purpose, and for how long.
• Security measures the processor has in place.
• Sub-processors: the tools and services you use that also handle the data (email, file-sharing software, cloud storage).
• Breach notification: timelines and steps if data is exposed or lost.
• Data-subject rights: access, correction, and deletion on request.
• Geographic location of data storage.
• Data deletion or return to the client at the end of the engagement.

Does a Small US Firm Actually Need One?

If all of your clients are US-based and outside regulated industries, a DPA may never come up. But if a client asks for one, refusing can cost you the engagement. More practically: having a documented process for how you handle client data is good practice regardless of legal requirements. Consult your legal advisor to understand which rules apply to your specific situation.

One practical step: use file-sharing tools that give you an audit trail you can point to. A dedicated client portal records who uploaded, downloaded, and previewed every file, making sub-processor disclosures concrete rather than theoretical. See how email compares to a dedicated client portal when handling sensitive client documents.

For a broader framework, the NIST Privacy Framework is a practical starting point for mapping the privacy practices your firm has in place before negotiating or signing a DPA.

What to Look for Before You Sign

When a client sends you a DPA to review:

• Check the scope: make sure it describes only the data you actually process, not a broader set you never touch.
• Review the sub-processor list you will need to disclose. Any tool that handles client data -- including file-sharing software -- goes on that list. Review your provider's privacy policy and sub-processor documentation before signing.
• Note breach-notification timing: some agreements require you to notify within 24 to 72 hours of discovering an issue.
• Read the data-deletion clause: you may be required to delete or return all data within a set window after the engagement ends.
• Flag anything that seems out of scope or impractical to your legal advisor before signing.

ProjectSend Cloud gives every client their own access-controlled space, with a full audit trail of every upload, download, and file preview -- the kind of concrete record that backs up what you write in a DPA. Check the security features and start free -- no credit card, no time limit -- from the plans page.