Explainers
Data Processing Agreement: What GDPR Requires and When You Need One
Solomon Amos · 29 Oct 2026 · 9 min read
legal
GDPR evidence across 471 vendors
GDPR has no certification in general use. What a buyer can verify is a data processing agreement, standard contractual clauses, an EU representative, data residency options, and an active Data Privacy Framework listing. CertReports records each of those as its own dated fact.
- Verified rows
- 0
- Vendor-stated
- 471
- Expired
- 0
- Last verified
- 1 Nov 2026
Revinate
Travel and hospitality
We power 950 million+ guest profiles and $17.2 billion in direct revenue for over 12,500 hotels
Articulate Global
Education
Articulate Global, LLC. (Articulate) was founded in 2002 to simplify e-learning development and expand access to training globally. The company offers its...
Contrast Security
Security
Secure AI-generated code with
Cornerstone OnDemand
HR and HRIS
About Cornerstone: Cornerstone powers the future-ready workforce with a next generation talent experience platform designed to unite
DataBank
Cloud and hosting
DataBank’s Managed Cloud transforms our Standard Cloud (IaaS) service into a comprehensively managed Platform-as-a-Service (PaaS)
Kentik Technologies
DevOps and observability
Kentik is the network intelligence platform for modern infrastructure
Moodle
moodle.com
OneStream Software
Finance and accounting
OneStream Software provides a revolutionary corporate performance management (CPM) solution that unifies and simplifies financial
Phenom People Inc. Phenom
Recruiting
Phenom is a global HR technology company that delivers its AI-powered Talent Experience Management (TXM) platform to enterprises, enabling
Contentful
Developer tools
Contentful is a German-American headless content management system (CMS), founded in 2013 in Berlin, Germany, by Sascha Konietzke and Paolo
OpenAI
AI infrastructure
OpenAI is an AI research and deployment
Dropbox
Cloud storage
Backup and share files in the cloud.
Twilio
Communications and CPaaS
Build amazing customer experiences on the Twilio platform with APIs for SMS, RCS, voice, and email, plus conversational AI for smarter
Diligent
Compliance and GRC
Diligent's trusted GRC software helps boards and leaders clarify risk, elevate governance, and manage compliance in one secure, AI-powered
A-LIGN
Compliance and GRC
Find out why A-LIGN is trusted by over 6,400 clients for efficient, reliable audits that meet rigorous compliance
KnowBe4
Education
Everything you need to reduce human risk and secure your agents all in one platform: Security Awareness Training, Email Security, Agent
Fivetran
Data platforms
The leader in automated data movement
BeyondTrust
Identity and access
BeyondTrust Corporation is an American company that develops privileged access management (PAM) and vulnerability management software
Everbridge
Compliance and GRC
Ensure the safety of your people and assets with the Everbridge comprehensive critical event and business continuity
Abnormal AI
AI tools
Abnormal AI is the leading AI-native human behavior security platform, leveraging machine learning to stop sophisticated inbound attacks
Envoy
Legal tech
We provide full-scale international legal immigration services and a proprietary online platform related to managing all employment-based
Docebo
Education
Docebo’s AI-powered LMS helps world-class organizations train employees, partners, and customers on a unified
Celonis
Analytics
Celonis has one very simple goal: to analyze today’s processes to make tomorrow’s world more
Druva
Cloud storage
The Druva Data Resiliency Cloud is the only at-scale SaaS platform designed for your multi-cloud
Data Privacy Framework
The EU-US DPF list is an official registry with annual recertification and a usage end date per participant. The General Court dismissed the challenge to the adequacy decision on 3 September 2025 (T-553/23); an appeal is pending at the Court of Justice (C-703/25 P).
DPA and subprocessors
"[vendor] dpa" and "[vendor] subprocessors" are among the most searched vendor questions. CertReports links the DPA and captures the subprocessor list with logos and change history where it is public.