Also: Data Processing Agreement · Data Processing Addendum
A contract governing how one company handles personal data on another's behalf — required under GDPR whenever a processor touches a controller's data.
If you sell to European businesses, customers will ask for one. If you use third-party services that touch your users' data — analytics, email, an AI provider, a support tool — you are relying on theirs.
The practical implication founders miss is the subprocessor list. Every vendor in your stack that sees personal data has to be disclosed, and the list has to stay current. Adding a new AI provider or analytics tool is a documentation event, not just a technical one.
It is a separate document from your privacy policy: the policy tells your users what you do, the DPA is a contract with a business customer about doing it on their behalf.
Project types where this term stops being vocabulary and starts being a decision you have to make.