A Guide to Data Processing Agreements for Survey Platforms

Any time your survey platform vendor processes personal data on your behalf, a Data Processing Agreement (DPA) is not optional under GDPR and is increasingly expected under other privacy frameworks. Here's what to actually look for in one.

What a DPA Covers

A proper DPA specifies the categories of personal data processed, the purpose and duration of processing, the sub-processors involved, security measures in place, breach notification obligations, and the process for data deletion or return at the end of the relationship.

Sub-Processor Transparency

Your vendor almost certainly uses their own sub-processors (cloud hosting, email delivery, analytics). A good DPA discloses the full sub-processor list and commits to notifying you before adding new ones, giving you the opportunity to object.

Data Transfer Mechanisms

If your vendor processes data outside your jurisdiction (common for US-based SaaS tools serving EU customers), the DPA should specify the legal transfer mechanism used — Standard Contractual Clauses being the most common — and confirm the vendor's compliance with it.

Breach Notification Timelines

Look for a specific, reasonable timeline for breach notification (typically 24-72 hours from discovery), since your own regulatory obligations to notify authorities and affected individuals start a clock that depends on when your vendor tells you about an incident.

Red Flags to Watch For

Vague or missing sub-processor disclosure, no specific breach notification timeline, and DPAs that reserve broad rights for the vendor to use your data for their own purposes beyond providing the service are all warning signs worth escalating before signing.

Reviewing DPAs on an Ongoing Basis

A DPA signed at the start of a vendor relationship can become outdated as the vendor's own infrastructure and sub-processor list evolves. Build a periodic review (at least annually) into your vendor management process, checking that the vendor's current practices still match what the DPA describes rather than treating the signed document as a one-time formality.

A well-drafted DPA protects both parties — it's not just a compliance checkbox, it's a genuine risk allocation document worth reading carefully rather than rubber-stamping.