If we (company) are buying a Saas licenses via a reseller, do we need a data processing agreement with the reseller or with the origial Saas provider.

Example: We buy a hosted email services. Company Z is the original provider of this email service, but we do not buy the licenses from company Z, but instead we buy from a local IT shop, company A. Do we need to have a data processing agreement with Company Z or Company A? Company A is in this example just a reseller of the license.

1 Answer 1


A DPA is typically between the software company and a third party. Company Z would need a DPA with Company A if they use Company A to process your data. Your Software License Agreement or Master Services Agreement with the software provider protects you. Company A uses a DPA to protect your data for you if hey contract out services for your data.

Not the answer you're looking for? Browse other questions tagged .