Outbound Glossary
Data processing agreement
The contract required when someone handles personal data on your behalf. Every tool in an outbound stack needs one, and most people never read them.
A DPA sets out what a processor may do with the data you give it, how it protects it, who it may pass it to and what happens when the relationship ends. Under GDPR it is not optional where a processor is involved.
In outbound the processor list is longer than it looks: the sending platform, the enrichment providers, the verification service, the CRM, and anyone they subcontract to. The sub-processor list inside those agreements is where the data actually travels, and it is the part worth reading, because it tells you which countries your prospect list has been to.