Explainers
Data Processing Agreement: What GDPR Requires and When You Need One
Solomon Amos · 29 Oct 2026 · 9 min read
legal
GDPR evidence across 471 vendors
GDPR has no certification in general use. What a buyer can verify is a data processing agreement, standard contractual clauses, an EU representative, data residency options, and an active Data Privacy Framework listing. CertReports records each of those as its own dated fact.
- Verified rows
- 0
- Vendor-stated
- 471
- Expired
- 0
- Last verified
- 1 Nov 2026
Navan
Travel and hospitality
Streamline your corporate travel management and expense processes in one
Sentry
DevOps and observability
Application performance monitoring for developers & software teams to see errors clearer, solve issues faster & continue learning
Vercel
Cloud and hosting
The autonomous stack for every app and
Fortinet
IoT and devices
Fortinet delivers award-winning cyber security solutions across the entire digital attack surface, securing devices, data, and
Bird
Communications and CPaaS
The world’s largest omnichannel communications platform
Otter.ai
AI assistants
Otter AI Meeting Agent supports real-time transcription, live chat, automated summaries, insights, and action
Miro
Collaboration
Speed up product development from ideation to
Railway
Cloud and hosting
Railway is a full-stack cloud for deploying web apps, servers, databases, and more with automatic scaling, monitoring, and
RingCentral
Communications and CPaaS
Power the voice of your business with RingCentral Agentic Voice AI, including AI Receptionist (AIR), AI Virtual Assistant (AVA), & AI
Palo Alto Networks
Identity and access
Protect your organization with
y
DevOps and observability
AI agents powering financial infrastructure for merchants, banks, and
Webflow
Design tools
Professional website design and publishing platform.
Postman
Developer tools
Postman is an API platform for building and using
Delinea
Identity and access
Try Delinea's AI-driven identity security, authorization and PAM solutions to secure privileged access across your organization in real
Amplitude
Analytics
Digital Analytics Platform
Dialpad
Communications and CPaaS
The only AI-driven, cloud-native business communications
Render
Cloud and hosting
Deploy and scale any app or agent from your first user to your
RADAR
Compliance and GRC
Manage privacy and AI incidents with speed and consistency using RadarFirst’s proven platform, AI-assisted capabilities, and regulatory
Netlify
Developer tools
Create with AI or code, deploy instantly on production
Pipedrive
CRM
Pipedrive is the easy-to-use, #1 user-rated CRM
FullStory
Analytics
Fullstory helps companies understand and improve how humans and AI agents interact with digital
Five9
Communications and CPaaS
Five9 delivers reliable cloud contact centre and AI services that empower organisations to deliver extraordinary customer
Personio
HR and HRIS
Apollo.io
Sales tools
Apollo is the foundation of your entire go-to-market strategy.
Data Privacy Framework
The EU-US DPF list is an official registry with annual recertification and a usage end date per participant. The General Court dismissed the challenge to the adequacy decision on 3 September 2025 (T-553/23); an appeal is pending at the Court of Justice (C-703/25 P).
DPA and subprocessors
"[vendor] dpa" and "[vendor] subprocessors" are among the most searched vendor questions. CertReports links the DPA and captures the subprocessor list with logos and change history where it is public.