Case Study | Review of Data Processing Agreement (DPA)

Sizebay is a startup that revolutionized the online fashion market through its SaaS ( software as a service ) platform, identified as a virtual fitting room . Through this tool, e-commerce users can discover their ideal size based on data such as weight, height, and age. This generates more confidence in purchasing, considering the reduced risk of needing to exchange items due to size issues.

Due to the startup's business model, in which it provides services and processes the data of e-commerce customers (Controllers) according to their guidelines and on their behalf, Sizebay assumes the position of "Data Processor" under the LGPD (Brazilian General Data Protection Law). (If you want to know more about data processing agents, access our ebook on the subject by clicking here ).

Given this context, it is common for the Controller to submit to the Processor a contractual instrument called a Data Processing Agreement ( DPA) . This governs all guidelines regarding data processing, such as how the processing will occur, its scope, purpose, limits, sharing, responsibilities, audits, penalties, among other issues. This ensures that data processing complies with the LGPD (Brazilian General Data Protection Law) and that both parties have legal security.

In this context, Sizebay received a Data Processing Agreement (DPA) from one of its international clients and, before signing, sought legal advice from Vanzin & Penteado to analyze the contract and provide recommendations. The scope defined and executed by the firm was:

1. Analyze and interpret the clauses of the DPA;
2. Carry out parallels between contractual requests and requirements with the client's operation;
3. Point out which contractual provisions were within and outside market practices;
4. Present the future consequences of each contractual provision;
5. Propose possible new wordings and changes to contractual provisions, as well as possible exclusions of clauses.

After the work was completed, the document was delivered to Sizebay in English, ready for feedback to the international client who, in turn, agreed to the adjustments and signed the contract.

Regarding the DPA ( Data Protection Agreement), it's worth highlighting that it's an increasingly used contractual instrument. It's an indispensable part of the supplier onboarding process in the service delivery chain, as it further strengthens the commitment to handling data appropriately and in compliance with regulations.

By Kael Moro