Data Protection Addendum (DPA)
GDPR Article 28 coverage for whenever your testing touches personal data.
What It Is
A Data Protection Addendum is required whenever your testing touches personal data — and it usually does, since in-scope systems handle user accounts, logs, or customer records. Under GDPR, the client (the data controller) is legally required to have a DPA with you (their processor) before you can lawfully process that data, even incidentally.
Why It Matters
Skipping it isn't a shortcut — it exposes the client to enforcement action under GDPR and leaves your own handling of any personal data you encounter during testing unregulated. Clients operating under GDPR (or similar regimes like the UK GDPR or Dutch AVG) will typically expect this alongside, not instead of, your NDA and MSA.