A software purchase usually involves four documents. The master agreement sets the general legal terms. The order form says what you bought and for how long. The data processing agreement covers personal data. The service level terms cover availability and support. Know which does what, and which wins if they conflict.
The four documents
Master agreement (MSA or terms of service). The general terms: payment, confidentiality, warranties, liability limits, termination, governing law. It stays the same across purchases.
Order form. The commercial specifics: product, quantity, term start and end, renewal terms, fees. Renewal and notice rules often sit here, so read it even if you skip the rest.
Data processing agreement (DPA). Applies when the vendor processes personal data for you. Under GDPR Article 28, processing by a processor must be governed by a binding contract that sets out the subject matter, duration, nature and purpose, types of data and categories of people. It also lists the processor duties covered in the next sections.
Service level terms (SLA). Uptime targets, support response times and the remedy if they are missed.
Some vendors add a security exhibit. It describes the vendor's controls and sometimes sets obligations such as breach notice timing.
Which document wins
Most agreements include an order of precedence clause. A common pattern is that the DPA wins on personal data, the order form wins on commercial terms, and the master agreement covers the rest. Check the actual text. If there is no precedence clause, ask for one.
What the DPA must contain
Article 28(3) lists the processor duties. In summary the processor must act only on documented instructions, bind its staff to confidentiality, apply the security measures required by Article 32, respect the conditions for subprocessors, assist with data subject requests and with breach and impact assessment duties, delete or return personal data at the end of the services, and make available information and allow audits. The contract must be in writing, including electronic form.
Questions to ask on each
- MSA: how is liability capped, and are data breaches treated differently from other claims?
- Order form: when does it renew, and how much notice ends it?
- DPA: how will we be told about new subprocessors, and can we object?
- SLA: what counts as downtime, and is the remedy a credit or a right to leave?
Do you always need a DPA
Only if the vendor processes personal data on your behalf. See whether a security scanner needs one.
Sources
Quick check
Is a DPA the same as a privacy policy?
No. A privacy policy is a notice to individuals. A DPA is a contract between a controller and a processor.
Which document usually has the renewal terms?
The order form, though the master agreement can also contain them.
Last reviewed: 19 October 2026.
