The data processing agreement (DPA) is one of the most important tools for ensuring that privacy issues are addressed formally – in a repeatable, documented process that is revisited periodically and that shows what functions are involved. Eran Kahana, counsel at Maslon LLP and fellow at Stanford Law School, and Michael L. Whitener, a partner at VLP Law Group LLP, explored common DPA terms and provisions during a Strafford webinar. They also discussed the most common pain points in negotiating DPAs, including liability limitations, sub-processing and data security, and practical solutions to reaching a mutually acceptable agreement. This article distills their insights. See “Expedia and Lululemon Privacy Pros Discuss Scaling Vendor Contracting for New Privacy Laws” (Apr. 19, 2023).