Data Processing Agreement (DPA)

Devotel processes personal data on your behalf as a processor, and you are the controller. GDPR Article 28 requires that relationship to be governed by a written contract — a Data Processing Agreement. Devotel exposes that contract as a self-serve click-wrap so you can review, accept, and archive it without a manual legal handoff. This guide covers the full lifecycle: what the DPA governs, how dpa_status works, how to preview the template, how to accept it, how to download the executed copy, and what happens when a new template version is published.

Acceptance is purely contractual record-keeping. It never gates sending, receive, or any other product capability.

What the DPA governs

The DPA binds Devotel to the processor obligations in Article 28(3) of the GDPR. In plain terms, it commits Devotel to:

Process personal data only on your documented instructions
Keep the data confidential and bound by appropriate security measures
Engage subprocessors only under the conditions the agreement describes, and remain liable for them
Assist you with data-subject requests (the counterpart to the DSAR workflow) and with breach notification
Delete or return personal data at the end of the engagement

Accepting the DPA does not change what Devotel does with your data — those obligations exist regardless. Acceptance is the written record Article 28 requires you, as the controller, to hold. Devotel makes that record a typed e-signature you can complete from the dashboard in a minute instead of a document routed through procurement. The typed e-signature is a click-wrap acceptance: you type your legal name to sign. Each acceptance records the template version, the signer’s name, email, and title, the acceptance timestamp, and the acceptance method (type-the-name). That record is the legal evidence of attestation; the rendered document stored on acceptance is the canonical executed copy.

States of `dpa_status`

Your organization is always in one of two states, reported by GET /api/v1/compliance/dpa:

State	Meaning
`not_accepted`	No DPA acceptance on file. This is the default for every new organization.
`accepted`	A DPA acceptance is on file. The response includes the accepted version, timestamp, and signer details.

Alongside the status, GET /api/v1/compliance/dpa returns a needs_update flag. It is true when the template version your organization accepted is older than the current canonical template version — for example, you accepted v1 and Devotel has since published v2. The flag is informational: nothing is blocked, and your existing acceptance remains on file. It drives the dashboard banner that offers re-acceptance so you can adopt the newer version. The response shape:

{
  "dpa_status": "accepted",
  "dpa_accepted_version": "v1",
  "dpa_accepted_at": "2026-08-10T14:22:31.410Z",
  "dpa_signer_name": "Jane Roe",
  "dpa_signer_email": "jane@example.com",
  "dpa_signer_title": "General Counsel",
  "current_version": "v1",
  "needs_update": false
}

Unlike the HIPAA BAA, the DPA has no annual term. It stays accepted until a newer template version is published, at which point needs_update becomes true — it never expires on its own.

Preview the template

Before accepting, review the exact agreement text. GET /api/v1/compliance/dpa/template returns the template rendered with your organization’s name already filled in, so you read the finalized agreement rather than a document full of placeholders. Fields that only exist once you accept — the acceptance timestamps and the document reference — appear as readable “filled in when you accept” markers. Signer fields appear as blanks the dashboard fills live as you type.

curl "https://api.orbit.devotel.io/api/v1/compliance/dpa/template?version=v1" \
  -H "Authorization: Bearer sk_live_..."

Response:

{
  "version": "v1",
  "controller_name": "Acme Health Ltd",
  "format": "markdown",
  "body": "# Data Processing Agreement\n\nThis Data Processing Agreement..."
}

Any role of admin or above can preview. The preview is identical for every caller in the organization and changes only when Devotel publishes a new template version.

Accept the DPA

Acceptance is owner-only — a legally binding signature is not a developer-tier action. POST /api/v1/compliance/dpa/accept takes the signer’s identity and a typed attestation:

curl -X POST "https://api.orbit.devotel.io/api/v1/compliance/dpa/accept" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "signer_name": "Jane Roe",
    "signer_email": "jane@example.com",
    "signer_title": "General Counsel",
    "typed_attestation": "Jane Roe"
  }'

Field	Rule
`signer_name`	The signer’s legal name (2–200 characters).
`signer_email`	A valid email address.
`signer_title`	The signer’s role or title (2–200 characters).
`typed_attestation`	Must exactly match `signer_name`. The signer re-types their name as the signature; a mismatch is rejected with a `400` (this also blocks blank-form auto-submits).
`template_version`	Optional. Defaults to the current canonical version.

On success, the server:

Renders the template with the signer details, acceptance timestamps, and a generated document reference
Stores the rendered document as the canonical executed copy
Records the acceptance on the organization — version, timestamp, signer — and appends it to an immutable acceptance history, so re-acceptances never erase the prior record
Writes a compliance.dpa.accepted entry to the audit log — the audit entry is the legal evidence of attestation

The response returns the new state plus the document reference:

{
  "dpa_status": "accepted",
  "dpa_accepted_version": "v1",
  "dpa_accepted_at": "2026-08-24T09:41:12.008Z",
  "dpa_signer_name": "Jane Roe",
  "dpa_signer_email": "jane@example.com",
  "dpa_signer_title": "General Counsel",
  "current_version": "v1",
  "needs_update": false,
  "dpa_id": "dpa_9f2k…"
}

Acceptance is rate-limited to a handful of requests per minute; it should be a deliberate action, not a scripted loop.

Download the executed copy

Once a DPA is on file, any admin or above can fetch it for your records, a customer’s audit, or a regulator:

curl "https://api.orbit.devotel.io/api/v1/compliance/dpa/download" \
  -H "Authorization: Bearer sk_live_..."

The response carries a download URL valid for 24 hours:

{
  "url": "https://storage.googleapis.com/…/dpa/org_…/dpa_….pdf?X-Goog-Signature=…",
  "expires_in_seconds": 86400
}

Share the URL within that window or download the file yourself and archive it. If no DPA has been accepted yet, the endpoint returns 404.

Dashboard flow

The same lifecycle is available without touching the API at Settings → Compliance → DPA:

Status card — shows not_accepted / accepted, the accepted version and date, the signer, and a banner when needs_update is true
Template preview — the rendered agreement with your organization’s name filled in
Attestation form — name, email, title, and the type-the-name signature field (owner only)
Download — a link to the executed copy once accepted

FAQ

What happens when needs_update turns true? Devotel published a newer template version than the one you accepted. Your existing acceptance stays fully on file and nothing is blocked. To adopt the new version, preview it (the version query parameter defaults to the current version), then accept again with the same flow. The new acceptance supersedes the status fields, and the earlier acceptance remains in the immutable acceptance history. Does re-accepting require the full form again? Yes. Each acceptance is an independent typed signature — the typed attestation must match the signer name every time. Who can do what?

Action	`owner`	`admin`	`developer` / `viewer` / `billing`
Read DPA status	Yes	Yes	No
Preview the template	Yes	Yes	No
Download the executed copy	Yes	Yes	No
Accept / re-accept	Yes	No	No

Does the DPA gate anything? No. Acceptance is contractual record-keeping. Unlike the BAA, which gates HIPAA mode and PHI sends, the DPA never blocks a product capability. What is my controller obligation beyond accepting? Accepting the DPA satisfies Article 28’s contract requirement on your side. Determining your lawful basis, configuring your own consent and suppression controls, and answering data-subject requests (see DSAR) remain yours. For the order those pieces go together, see Assembling a GDPR Posture End to End.

Last updated: August 2026 For questions about the DPA, contact: compliance@devotel.io

Getting Started

Channels

AI Agents

Flows

Numbers & Verify

Concepts

Features

Billing

Webhooks

Security & SSO

Compliance

Legal

Changelog

Data Processing Agreement (GDPR Article 28)

Data Processing Agreement (DPA)

What the DPA governs

States of `dpa_status`

Preview the template

Accept the DPA

Download the executed copy

Dashboard flow

FAQ

​Data Processing Agreement (DPA)

​What the DPA governs

​States of dpa_status

​Preview the template

​Accept the DPA

​Download the executed copy

​Dashboard flow

​FAQ

Data Processing Agreement (DPA)

What the DPA governs

States of `dpa_status`

Preview the template

Accept the DPA

Download the executed copy

Dashboard flow

FAQ