Add dpa on vendors

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

apps/console/src/hooks/graph/VendorGraph.ts

@@ -155,6 +155,7 @@ export const vendorNodeQuery = graphql`
         ...VendorContactsTabFragment
         ...VendorRiskAssessmentTabFragment
         ...VendorOverviewTabBusinessAssociateAgreementFragment
+        ...VendorOverviewTabDataPrivacyAgreementFragment
       }
     }
     viewer {

apps/console/src/hooks/graph/__generated__/VendorGraphNodeQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<da74b0f7535be59a3442b643c71931d7>>
+ * @generated SignedSource<<b7911bef9124adb41e7337c903b4910f>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -19,7 +19,7 @@ export type VendorGraphNodeQuery$data = {
     readonly id?: string;
     readonly name?: string;
     readonly websiteUrl?: string | null | undefined;
-    readonly " $fragmentSpreads": FragmentRefs<"VendorComplianceTabFragment" | "VendorContactsTabFragment" | "VendorOverviewTabBusinessAssociateAgreementFragment" | "VendorRiskAssessmentTabFragment" | "useVendorFormFragment">;
+    readonly " $fragmentSpreads": FragmentRefs<"VendorComplianceTabFragment" | "VendorContactsTabFragment" | "VendorOverviewTabBusinessAssociateAgreementFragment" | "VendorOverviewTabDataPrivacyAgreementFragment" | "VendorRiskAssessmentTabFragment" | "useVendorFormFragment">;
   };
   readonly viewer: {
     readonly user: {
@@ -198,7 +198,27 @@ v21 = {
   "kind": "ScalarField",
   "name": "createdAt",
   "storageKey": null
-};
+},
+v22 = [
+  (v3/*: any*/),
+  {
+    "alias": null,
+    "args": null,
+    "kind": "ScalarField",
+    "name": "fileName",
+    "storageKey": null
+  },
+  (v11/*: any*/),
+  {
+    "alias": null,
+    "args": null,
+    "kind": "ScalarField",
+    "name": "validFrom",
+    "storageKey": null
+  },
+  (v10/*: any*/),
+  (v21/*: any*/)
+];
 return {
   "fragment": {
     "argumentDefinitions": [
@@ -247,6 +267,11 @@ return {
                 "args": null,
                 "kind": "FragmentSpread",
                 "name": "VendorOverviewTabBusinessAssociateAgreementFragment"
+              },
+              {
+                "args": null,
+                "kind": "FragmentSpread",
+                "name": "VendorOverviewTabDataPrivacyAgreementFragment"
               }
             ],
             "type": "Vendor",
@@ -666,26 +691,17 @@ return {
                 "kind": "LinkedField",
                 "name": "businessAssociateAgreement",
                 "plural": false,
-                "selections": [
+                "selections": (v22/*: any*/),
-                  (v3/*: any*/),
+                "storageKey": null
-                  {
+              },
-                    "alias": null,
+              {
-                    "args": null,
+                "alias": null,
-                    "kind": "ScalarField",
+                "args": null,
-                    "name": "fileName",
+                "concreteType": "VendorDataPrivacyAgreement",
-                    "storageKey": null
+                "kind": "LinkedField",
-                  },
+                "name": "dataPrivacyAgreement",
-                  (v11/*: any*/),
+                "plural": false,
-                  {
+                "selections": (v22/*: any*/),
-                    "alias": null,
-                    "args": null,
-                    "kind": "ScalarField",
-                    "name": "validFrom",
-                    "storageKey": null
-                  },
-                  (v10/*: any*/),
-                  (v21/*: any*/)
-                ],
                 "storageKey": null
               }
             ],
@@ -723,16 +739,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "506d89b503073e18cbf657aec5d62c71",
+    "cacheID": "5e87c78ed85f28f7390e2aada6c241e8",
     "id": null,
     "metadata": {},
     "name": "VendorGraphNodeQuery",
     "operationKind": "query",
-    "text": "query VendorGraphNodeQuery(\n  $vendorId: ID!\n  $organizationId: ID!\n) {\n  node(id: $vendorId) {\n    __typename\n    ... on Vendor {\n      id\n      name\n      websiteUrl\n      ...useVendorFormFragment\n      ...VendorComplianceTabFragment\n      ...VendorContactsTabFragment\n      ...VendorRiskAssessmentTabFragment\n      ...VendorOverviewTabBusinessAssociateAgreementFragment\n    }\n    id\n  }\n  viewer {\n    user {\n      people(organizationId: $organizationId) {\n        id\n      }\n      id\n    }\n    id\n  }\n}\n\nfragment VendorComplianceTabFragment on Vendor {\n  complianceReports(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorComplianceTabFragment_report\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorComplianceTabFragment_report on VendorComplianceReport {\n  id\n  reportDate\n  validUntil\n  reportName\n  fileUrl\n  fileSize\n}\n\nfragment VendorContactsTabFragment on Vendor {\n  contacts(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorContactsTabFragment_contact\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorContactsTabFragment_contact on VendorContact {\n  id\n  fullName\n  email\n  phone\n  role\n  createdAt\n  updatedAt\n}\n\nfragment VendorOverviewTabBusinessAssociateAgreementFragment on Vendor {\n  businessAssociateAgreement {\n    id\n    fileName\n    fileUrl\n    validFrom\n    validUntil\n    createdAt\n  }\n}\n\nfragment VendorRiskAssessmentTabFragment on Vendor {\n  id\n  riskAssessments(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorRiskAssessmentTabFragment_assessment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      endCursor\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment VendorRiskAssessmentTabFragment_assessment on VendorRiskAssessment {\n  id\n  assessedAt\n  assessedBy {\n    id\n    fullName\n  }\n  expiresAt\n  dataSensitivity\n  businessImpact\n  notes\n}\n\nfragment useVendorFormFragment on Vendor {\n  id\n  name\n  description\n  statusPageUrl\n  termsOfServiceUrl\n  privacyPolicyUrl\n  serviceLevelAgreementUrl\n  dataProcessingAgreementUrl\n  websiteUrl\n  legalName\n  headquarterAddress\n  certifications\n  securityPageUrl\n  trustPageUrl\n  businessOwner {\n    id\n  }\n  securityOwner {\n    id\n  }\n}\n"
+    "text": "query VendorGraphNodeQuery(\n  $vendorId: ID!\n  $organizationId: ID!\n) {\n  node(id: $vendorId) {\n    __typename\n    ... on Vendor {\n      id\n      name\n      websiteUrl\n      ...useVendorFormFragment\n      ...VendorComplianceTabFragment\n      ...VendorContactsTabFragment\n      ...VendorRiskAssessmentTabFragment\n      ...VendorOverviewTabBusinessAssociateAgreementFragment\n      ...VendorOverviewTabDataPrivacyAgreementFragment\n    }\n    id\n  }\n  viewer {\n    user {\n      people(organizationId: $organizationId) {\n        id\n      }\n      id\n    }\n    id\n  }\n}\n\nfragment VendorComplianceTabFragment on Vendor {\n  complianceReports(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorComplianceTabFragment_report\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorComplianceTabFragment_report on VendorComplianceReport {\n  id\n  reportDate\n  validUntil\n  reportName\n  fileUrl\n  fileSize\n}\n\nfragment VendorContactsTabFragment on Vendor {\n  contacts(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorContactsTabFragment_contact\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorContactsTabFragment_contact on VendorContact {\n  id\n  fullName\n  email\n  phone\n  role\n  createdAt\n  updatedAt\n}\n\nfragment VendorOverviewTabBusinessAssociateAgreementFragment on Vendor {\n  businessAssociateAgreement {\n    id\n    fileName\n    fileUrl\n    validFrom\n    validUntil\n    createdAt\n  }\n}\n\nfragment VendorOverviewTabDataPrivacyAgreementFragment on Vendor {\n  dataPrivacyAgreement {\n    id\n    fileName\n    fileUrl\n    validFrom\n    validUntil\n    createdAt\n  }\n}\n\nfragment VendorRiskAssessmentTabFragment on Vendor {\n  id\n  riskAssessments(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorRiskAssessmentTabFragment_assessment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      endCursor\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment VendorRiskAssessmentTabFragment_assessment on VendorRiskAssessment {\n  id\n  assessedAt\n  assessedBy {\n    id\n    fullName\n  }\n  expiresAt\n  dataSensitivity\n  businessImpact\n  notes\n}\n\nfragment useVendorFormFragment on Vendor {\n  id\n  name\n  description\n  statusPageUrl\n  termsOfServiceUrl\n  privacyPolicyUrl\n  serviceLevelAgreementUrl\n  dataProcessingAgreementUrl\n  websiteUrl\n  legalName\n  headquarterAddress\n  certifications\n  securityPageUrl\n  trustPageUrl\n  businessOwner {\n    id\n  }\n  securityOwner {\n    id\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "b5ea2120ec2f0f09ed29e19bbf232622";
+(node as any).hash = "82f82a56df0ea5b755937ebcc55c1382";
 
 export default node;

apps/console/src/pages/organizations/vendors/dialogs/DeleteDataPrivacyAgreementDialog.tsx

@@ -0,0 +1,89 @@
+import {
+  Button,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  Spinner,
+  useDialogRef,
+} from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import { sprintf } from "@probo/helpers";
+import { graphql } from "react-relay";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+
+const deleteDataPrivacyAgreementMutation = graphql`
+  mutation DeleteDataPrivacyAgreementDialogMutation(
+    $input: DeleteVendorDataPrivacyAgreementInput!
+  ) {
+    deleteVendorDataPrivacyAgreement(input: $input) {
+      deletedVendorId
+    }
+  }
+`;
+
+type Props = {
+  children: React.ReactNode;
+  vendorId: string;
+  fileName: string;
+  onSuccess?: () => void;
+};
+
+export function DeleteDataPrivacyAgreementDialog({
+  children,
+  vendorId,
+  fileName,
+  onSuccess,
+}: Props) {
+  const { __ } = useTranslate();
+  const ref = useDialogRef();
+
+  const [mutate, isDeleting] = useMutationWithToasts(deleteDataPrivacyAgreementMutation, {
+    successMessage: __("Data Privacy Agreement deleted successfully"),
+    errorMessage: __("Failed to delete Data Privacy Agreement"),
+  });
+
+  const handleDelete = async () => {
+    await mutate({
+      variables: {
+        input: {
+          vendorId,
+        },
+      },
+    });
+
+    onSuccess?.();
+    ref.current?.close();
+  };
+
+  return (
+    <Dialog
+      ref={ref}
+      trigger={children}
+      title={__("Delete Data Privacy Agreement")}
+      className="max-w-md"
+    >
+      <DialogContent padded>
+        <p className="text-txt-secondary">
+          {sprintf(
+            __("Are you sure you want to delete the Data Privacy Agreement \"%s\"?"),
+            fileName
+          )}
+        </p>
+        <p className="text-txt-secondary mt-2">
+          {__("This action cannot be undone.")}
+        </p>
+      </DialogContent>
+
+      <DialogFooter>
+        <Button
+          variant="danger"
+          onClick={handleDelete}
+          disabled={isDeleting}
+          icon={isDeleting ? Spinner : undefined}
+        >
+          {__("Delete")}
+        </Button>
+      </DialogFooter>
+    </Dialog>
+  );
+}

apps/console/src/pages/organizations/vendors/dialogs/EditDataPrivacyAgreementDialog.tsx

@@ -0,0 +1,135 @@
+import {
+  Button,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  Field,
+  Input,
+  Spinner,
+  useDialogRef,
+} from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import { graphql } from "react-relay";
+import { z } from "zod";
+import { useFormWithSchema } from "/hooks/useFormWithSchema";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+
+const updateDataPrivacyAgreementMutation = graphql`
+  mutation EditDataPrivacyAgreementDialogMutation(
+    $input: UpdateVendorDataPrivacyAgreementInput!
+  ) {
+    updateVendorDataPrivacyAgreement(input: $input) {
+      vendorDataPrivacyAgreement {
+        id
+        fileUrl
+        validFrom
+        validUntil
+        createdAt
+      }
+    }
+  }
+`;
+
+const schema = z.object({
+  validFrom: z.string().optional(),
+  validUntil: z.string().optional(),
+});
+
+type Props = {
+  children: React.ReactNode;
+  vendorId: string;
+  agreement: {
+    validFrom?: string | null;
+    validUntil?: string | null;
+  };
+  onSuccess?: () => void;
+};
+
+export function EditDataPrivacyAgreementDialog({
+  children,
+  vendorId,
+  agreement,
+  onSuccess,
+}: Props) {
+  const { __ } = useTranslate();
+  const ref = useDialogRef();
+
+  const formatDateForForm = (datetime?: string | null) => {
+    if (!datetime) return "";
+    return datetime.split("T")[0];
+  };
+
+  const {
+    register,
+    handleSubmit,
+    formState: { isSubmitting },
+    reset,
+  } = useFormWithSchema(schema, {
+    defaultValues: {
+      validFrom: formatDateForForm(agreement.validFrom),
+      validUntil: formatDateForForm(agreement.validUntil),
+    },
+  });
+
+  const [mutate] = useMutationWithToasts(updateDataPrivacyAgreementMutation, {
+    successMessage: __("Data Privacy Agreement updated successfully"),
+    errorMessage: __("Failed to update Data Privacy Agreement"),
+  });
+
+  const onSubmit = handleSubmit(async (data) => {
+    const formatDatetime = (dateString?: string) => {
+      if (!dateString) return null;
+      return `${dateString}T00:00:00Z`;
+    };
+
+    await mutate({
+      variables: {
+        input: {
+          vendorId,
+          validFrom: formatDatetime(data.validFrom),
+          validUntil: formatDatetime(data.validUntil),
+        },
+      },
+    });
+
+    onSuccess?.();
+    ref.current?.close();
+  });
+
+  const handleClose = () => {
+    reset();
+  };
+
+  return (
+    <Dialog
+      title={__("Edit Data Privacy Agreement")}
+      ref={ref}
+      trigger={children}
+      className="max-w-lg"
+      onClose={handleClose}
+    >
+      <form onSubmit={onSubmit}>
+        <DialogContent padded className="space-y-4">
+          <div className="grid grid-cols-2 gap-4">
+            <Field label={__("Valid from")}>
+              <Input {...register("validFrom")} type="date" />
+            </Field>
+            <Field label={__("Valid until")}>
+              <Input {...register("validUntil")} type="date" />
+            </Field>
+          </div>
+        </DialogContent>
+
+        <DialogFooter>
+          <Button
+            type="submit"
+            disabled={isSubmitting}
+            icon={isSubmitting ? Spinner : undefined}
+          >
+            {__("Update")}
+          </Button>
+        </DialogFooter>
+      </form>
+    </Dialog>
+  );
+}

apps/console/src/pages/organizations/vendors/dialogs/UploadDataPrivacyAgreementDialog.tsx

@@ -0,0 +1,178 @@
+import {
+  Button,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  Dropzone,
+  Field,
+  Spinner,
+  Input,
+  useDialogRef,
+} from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import { graphql } from "react-relay";
+import { z } from "zod";
+import { useFormWithSchema } from "/hooks/useFormWithSchema";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+import { useState } from "react";
+
+const uploadDataPrivacyAgreementMutation = graphql`
+  mutation UploadDataPrivacyAgreementDialogMutation(
+    $input: UploadVendorDataPrivacyAgreementInput!
+  ) {
+    uploadVendorDataPrivacyAgreement(input: $input) {
+      vendorDataPrivacyAgreement {
+        id
+        fileName
+        fileUrl
+        validFrom
+        validUntil
+        createdAt
+      }
+    }
+  }
+`;
+
+const schema = z.object({
+  fileName: z.string().min(1, "File name is required"),
+  validFrom: z.string().optional(),
+  validUntil: z.string().optional(),
+});
+
+type Props = {
+  children: React.ReactNode;
+  vendorId: string;
+  onSuccess?: () => void;
+};
+
+export function UploadDataPrivacyAgreementDialog({
+  children,
+  vendorId,
+  onSuccess,
+}: Props) {
+  const { __ } = useTranslate();
+  const [uploadedFile, setUploadedFile] = useState<File | null>(null);
+  const ref = useDialogRef();
+
+  const {
+    register,
+    handleSubmit,
+    formState: { errors, isSubmitting },
+    reset,
+    setValue,
+  } = useFormWithSchema(schema, {
+    defaultValues: {
+      fileName: "",
+      validFrom: "",
+      validUntil: "",
+    },
+  });
+
+  const [mutate] = useMutationWithToasts(uploadDataPrivacyAgreementMutation, {
+    successMessage: __("Data Privacy Agreement uploaded successfully"),
+    errorMessage: __("Failed to upload Data Privacy Agreement"),
+  });
+
+  const handleDrop = (files: File[]) => {
+    if (files.length > 0) {
+      const file = files[0];
+      setUploadedFile(file);
+      setValue("fileName", file.name);
+    }
+  };
+
+  const onSubmit = handleSubmit(async (data) => {
+    if (!uploadedFile) {
+      return;
+    }
+
+    const formatDatetime = (dateString?: string) => {
+      if (!dateString) return null;
+      return `${dateString}T00:00:00Z`;
+    };
+
+    await mutate({
+      variables: {
+        input: {
+          vendorId,
+          fileName: data.fileName,
+          validFrom: formatDatetime(data.validFrom),
+          validUntil: formatDatetime(data.validUntil),
+          file: null,
+        },
+      },
+      uploadables: {
+        "input.file": uploadedFile,
+      },
+    });
+
+    reset();
+    setUploadedFile(null);
+    onSuccess?.();
+    ref.current?.close();
+  });
+
+  const handleClose = () => {
+    reset();
+    setUploadedFile(null);
+  };
+
+  return (
+    <Dialog
+      title={__("Upload Data Privacy Agreement")}
+      ref={ref}
+      trigger={children}
+      className="max-w-lg"
+      onClose={handleClose}
+    >
+        <form onSubmit={onSubmit}>
+          <DialogContent padded className="space-y-4">
+            <Dropzone
+              description={__("Only PDF files up to 10MB are allowed")}
+              isUploading={isSubmitting}
+              onDrop={handleDrop}
+              accept={{
+                "application/pdf": [".pdf"],
+              }}
+              maxSize={10}
+            />
+
+            {uploadedFile && (
+              <div className="p-3 bg-tertiary-subtle rounded-lg">
+                <p className="text-sm font-medium">{__("Selected file")}:</p>
+                <p className="text-sm text-txt-secondary">{uploadedFile.name}</p>
+              </div>
+            )}
+
+            <Field
+              {...register("fileName")}
+              label={__("File name")}
+              type="text"
+              required
+              error={errors.fileName?.message}
+              placeholder={__("Data Privacy Agreement")}
+            />
+
+            <div className="grid grid-cols-2 gap-4">
+              <Field label={__("Valid from")}>
+                <Input {...register("validFrom")} type="date" />
+              </Field>
+              <Field label={__("Valid until")}>
+                <Input {...register("validUntil")} type="date" />
+              </Field>
+            </div>
+          </DialogContent>
+
+          <DialogFooter>
+            <Button
+              type="submit"
+              disabled={isSubmitting || !uploadedFile}
+              icon={isSubmitting ? Spinner : undefined}
+            >
+              {__("Upload")}
+            </Button>
+          </DialogFooter>
+        </form>
+      </Dialog>
+    );
+}

apps/console/src/pages/organizations/vendors/dialogs/__generated__/DeleteDataPrivacyAgreementDialogMutation.graphql.ts

@@ -0,0 +1,92 @@
+/**
+ * @generated SignedSource<<4d1711d74f82bc8952b162a37dd8931e>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteVendorDataPrivacyAgreementInput = {
+  vendorId: string;
+};
+export type DeleteDataPrivacyAgreementDialogMutation$variables = {
+  input: DeleteVendorDataPrivacyAgreementInput;
+};
+export type DeleteDataPrivacyAgreementDialogMutation$data = {
+  readonly deleteVendorDataPrivacyAgreement: {
+    readonly deletedVendorId: string;
+  };
+};
+export type DeleteDataPrivacyAgreementDialogMutation = {
+  response: DeleteDataPrivacyAgreementDialogMutation$data;
+  variables: DeleteDataPrivacyAgreementDialogMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "DeleteVendorDataPrivacyAgreementPayload",
+    "kind": "LinkedField",
+    "name": "deleteVendorDataPrivacyAgreement",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedVendorId",
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "DeleteDataPrivacyAgreementDialogMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "DeleteDataPrivacyAgreementDialogMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "683fac4979ff59534ce2acaa05d82063",
+    "id": null,
+    "metadata": {},
+    "name": "DeleteDataPrivacyAgreementDialogMutation",
+    "operationKind": "mutation",
+    "text": "mutation DeleteDataPrivacyAgreementDialogMutation(\n  $input: DeleteVendorDataPrivacyAgreementInput!\n) {\n  deleteVendorDataPrivacyAgreement(input: $input) {\n    deletedVendorId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "38cb9bcb710db551eda7ed8cff9fca5a";
+
+export default node;

apps/console/src/pages/organizations/vendors/dialogs/__generated__/EditDataPrivacyAgreementDialogMutation.graphql.ts

@@ -0,0 +1,139 @@
+/**
+ * @generated SignedSource<<161930fef961066719e45ce1f899dd38>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type UpdateVendorDataPrivacyAgreementInput = {
+  validFrom?: any | null | undefined;
+  validUntil?: any | null | undefined;
+  vendorId: string;
+};
+export type EditDataPrivacyAgreementDialogMutation$variables = {
+  input: UpdateVendorDataPrivacyAgreementInput;
+};
+export type EditDataPrivacyAgreementDialogMutation$data = {
+  readonly updateVendorDataPrivacyAgreement: {
+    readonly vendorDataPrivacyAgreement: {
+      readonly createdAt: any;
+      readonly fileUrl: string;
+      readonly id: string;
+      readonly validFrom: any | null | undefined;
+      readonly validUntil: any | null | undefined;
+    };
+  };
+};
+export type EditDataPrivacyAgreementDialogMutation = {
+  response: EditDataPrivacyAgreementDialogMutation$data;
+  variables: EditDataPrivacyAgreementDialogMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "UpdateVendorDataPrivacyAgreementPayload",
+    "kind": "LinkedField",
+    "name": "updateVendorDataPrivacyAgreement",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "concreteType": "VendorDataPrivacyAgreement",
+        "kind": "LinkedField",
+        "name": "vendorDataPrivacyAgreement",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "id",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "fileUrl",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "validFrom",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "validUntil",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "createdAt",
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "EditDataPrivacyAgreementDialogMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "EditDataPrivacyAgreementDialogMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "e84e9f9457d6e4dc295578e540aa3e64",
+    "id": null,
+    "metadata": {},
+    "name": "EditDataPrivacyAgreementDialogMutation",
+    "operationKind": "mutation",
+    "text": "mutation EditDataPrivacyAgreementDialogMutation(\n  $input: UpdateVendorDataPrivacyAgreementInput!\n) {\n  updateVendorDataPrivacyAgreement(input: $input) {\n    vendorDataPrivacyAgreement {\n      id\n      fileUrl\n      validFrom\n      validUntil\n      createdAt\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "b2caa3bc89953896a848ee77fd96a767";
+
+export default node;

apps/console/src/pages/organizations/vendors/dialogs/__generated__/UploadDataPrivacyAgreementDialogMutation.graphql.ts

@@ -0,0 +1,149 @@
+/**
+ * @generated SignedSource<<6d5f65677b0f86e7042fd5f7c58d6f08>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type UploadVendorDataPrivacyAgreementInput = {
+  file: any;
+  fileName: string;
+  validFrom?: any | null | undefined;
+  validUntil?: any | null | undefined;
+  vendorId: string;
+};
+export type UploadDataPrivacyAgreementDialogMutation$variables = {
+  input: UploadVendorDataPrivacyAgreementInput;
+};
+export type UploadDataPrivacyAgreementDialogMutation$data = {
+  readonly uploadVendorDataPrivacyAgreement: {
+    readonly vendorDataPrivacyAgreement: {
+      readonly createdAt: any;
+      readonly fileName: string;
+      readonly fileUrl: string;
+      readonly id: string;
+      readonly validFrom: any | null | undefined;
+      readonly validUntil: any | null | undefined;
+    };
+  };
+};
+export type UploadDataPrivacyAgreementDialogMutation = {
+  response: UploadDataPrivacyAgreementDialogMutation$data;
+  variables: UploadDataPrivacyAgreementDialogMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "UploadVendorDataPrivacyAgreementPayload",
+    "kind": "LinkedField",
+    "name": "uploadVendorDataPrivacyAgreement",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "concreteType": "VendorDataPrivacyAgreement",
+        "kind": "LinkedField",
+        "name": "vendorDataPrivacyAgreement",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "id",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "fileName",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "fileUrl",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "validFrom",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "validUntil",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "createdAt",
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "UploadDataPrivacyAgreementDialogMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "UploadDataPrivacyAgreementDialogMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "c59302d882fc9406dd7f09072db552b5",
+    "id": null,
+    "metadata": {},
+    "name": "UploadDataPrivacyAgreementDialogMutation",
+    "operationKind": "mutation",
+    "text": "mutation UploadDataPrivacyAgreementDialogMutation(\n  $input: UploadVendorDataPrivacyAgreementInput!\n) {\n  uploadVendorDataPrivacyAgreement(input: $input) {\n    vendorDataPrivacyAgreement {\n      id\n      fileName\n      fileUrl\n      validFrom\n      validUntil\n      createdAt\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "8e4e70e111836cebd850061a75872980";
+
+export default node;

apps/console/src/pages/organizations/vendors/tabs/VendorOverviewTab.tsx

@@ -11,8 +11,12 @@ import { useFragment, graphql } from "react-relay";
 import { UploadBusinessAssociateAgreementDialog } from "../dialogs/UploadBusinessAssociateAgreementDialog";
 import { DeleteBusinessAssociateAgreementDialog } from "../dialogs/DeleteBusinessAssociateAgreementDialog";
 import { EditBusinessAssociateAgreementDialog } from "../dialogs/EditBusinessAssociateAgreementDialog";
+import { UploadDataPrivacyAgreementDialog } from "../dialogs/UploadDataPrivacyAgreementDialog";
+import { DeleteDataPrivacyAgreementDialog } from "../dialogs/DeleteDataPrivacyAgreementDialog";
+import { EditDataPrivacyAgreementDialog } from "../dialogs/EditDataPrivacyAgreementDialog";
 import type { useVendorFormFragment$key } from "/hooks/forms/__generated__/useVendorFormFragment.graphql";
 import type { VendorOverviewTabBusinessAssociateAgreementFragment$key } from "./__generated__/VendorOverviewTabBusinessAssociateAgreementFragment.graphql";
+import type { VendorOverviewTabDataPrivacyAgreementFragment$key } from "./__generated__/VendorOverviewTabDataPrivacyAgreementFragment.graphql";
 
 const vendorBusinessAssociateAgreementFragment = graphql`
   fragment VendorOverviewTabBusinessAssociateAgreementFragment on Vendor {
@@ -27,13 +31,26 @@ const vendorBusinessAssociateAgreementFragment = graphql`
   }
 `;
 
+const vendorDataPrivacyAgreementFragment = graphql`
+  fragment VendorOverviewTabDataPrivacyAgreementFragment on Vendor {
+    dataPrivacyAgreement {
+      id
+      fileName
+      fileUrl
+      validFrom
+      validUntil
+      createdAt
+    }
+  }
+`;
+
 export default function VendorOverviewTab() {
   const { vendor } = useOutletContext<{
     vendor: useVendorFormFragment$key & { id: string; name: string };
   }>();
 
   const { vendor: vendorForBAA } = useOutletContext<{
-    vendor: VendorOverviewTabBusinessAssociateAgreementFragment$key;
+    vendor: VendorOverviewTabBusinessAssociateAgreementFragment$key & VendorOverviewTabDataPrivacyAgreementFragment$key;
   }>();
 
   const { __ } = useTranslate();
@@ -52,6 +69,12 @@ export default function VendorOverviewTab() {
   );
   const businessAssociateAgreement = vendorWithBAA.businessAssociateAgreement;
 
+  const vendorWithDPA = useFragment<VendorOverviewTabDataPrivacyAgreementFragment$key>(
+    vendorDataPrivacyAgreementFragment,
+    vendorForBAA
+  );
+  const dataPrivacyAgreement = vendorWithDPA.dataPrivacyAgreement;
+
   const urls = useMemo(
     () =>
       [
@@ -227,6 +250,69 @@ export default function VendorOverviewTab() {
               )}
             </div>
           </div>
+
+          <div className="flex items-center justify-between p-4 border border-border-low rounded-lg">
+            <div className="flex-1">
+              <h3 className="font-medium text-txt-primary">
+                {__("Data Privacy Agreement")}
+              </h3>
+              <p className="text-sm text-txt-secondary mt-1">
+                {dataPrivacyAgreement ? dataPrivacyAgreement.fileName : __("No data privacy agreement available")}
+              </p>
+              {(dataPrivacyAgreement?.validFrom || dataPrivacyAgreement?.validUntil) && (
+                <p className="text-xs text-txt-secondary mt-1">
+                  {__("Valid")}
+                  {dataPrivacyAgreement.validFrom &&
+                    ` ${__("from")} ${new Date(dataPrivacyAgreement.validFrom).toLocaleDateString()}`
+                  }
+                  {dataPrivacyAgreement.validUntil &&
+                    ` ${__("until")} ${new Date(dataPrivacyAgreement.validUntil).toLocaleDateString()}`
+                  }
+                </p>
+              )}
+            </div>
+            <div className="flex items-center gap-2">
+              {dataPrivacyAgreement ? (
+                <>
+                  <Button
+                    type="button"
+                    variant="secondary"
+                    onClick={() => downloadFile(dataPrivacyAgreement.fileUrl, dataPrivacyAgreement.fileName)}
+                  >
+                    {__("Download PDF")}
+                  </Button>
+                  <EditDataPrivacyAgreementDialog
+                    vendorId={vendor.id}
+                    agreement={{
+                      validFrom: dataPrivacyAgreement.validFrom,
+                      validUntil: dataPrivacyAgreement.validUntil,
+                    }}
+                    onSuccess={() => window.location.reload()}
+                  >
+                    <Button variant="quaternary" icon={IconPencil} />
+                  </EditDataPrivacyAgreementDialog>
+                  <DeleteDataPrivacyAgreementDialog
+                    vendorId={vendor.id}
+                    fileName={dataPrivacyAgreement.fileName}
+                    onSuccess={() => window.location.reload()}
+                  >
+                    <Button variant="quaternary" icon={IconTrashCan} />
+                  </DeleteDataPrivacyAgreementDialog>
+                </>
+              ) : (
+                <>
+                  <UploadDataPrivacyAgreementDialog
+                    vendorId={vendor.id}
+                    onSuccess={() => window.location.reload()}
+                  >
+                    <Button variant="secondary" icon={IconPlusLarge}>
+                      {__("Upload")}
+                    </Button>
+                  </UploadDataPrivacyAgreementDialog>
+                </>
+              )}
+            </div>
+          </div>
         </Card>
       </div>
 

apps/console/src/pages/organizations/vendors/tabs/__generated__/VendorOverviewTabDataPrivacyAgreementFragment.graphql.ts

@@ -0,0 +1,95 @@
+/**
+ * @generated SignedSource<<03e78d5a57f41471ed7099febe61e666>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ReaderFragment } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type VendorOverviewTabDataPrivacyAgreementFragment$data = {
+  readonly dataPrivacyAgreement: {
+    readonly createdAt: any;
+    readonly fileName: string;
+    readonly fileUrl: string;
+    readonly id: string;
+    readonly validFrom: any | null | undefined;
+    readonly validUntil: any | null | undefined;
+  } | null | undefined;
+  readonly " $fragmentType": "VendorOverviewTabDataPrivacyAgreementFragment";
+};
+export type VendorOverviewTabDataPrivacyAgreementFragment$key = {
+  readonly " $data"?: VendorOverviewTabDataPrivacyAgreementFragment$data;
+  readonly " $fragmentSpreads": FragmentRefs<"VendorOverviewTabDataPrivacyAgreementFragment">;
+};
+
+const node: ReaderFragment = {
+  "argumentDefinitions": [],
+  "kind": "Fragment",
+  "metadata": null,
+  "name": "VendorOverviewTabDataPrivacyAgreementFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "VendorDataPrivacyAgreement",
+      "kind": "LinkedField",
+      "name": "dataPrivacyAgreement",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "id",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "fileName",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "fileUrl",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "validFrom",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "validUntil",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "createdAt",
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "type": "Vendor",
+  "abstractKey": null
+};
+
+(node as any).hash = "9a3e19e369a57ce4c1dd08760d244b74";
+
+export default node;

pkg/coredata/entity_type_reg.go

@@ -42,4 +42,5 @@ const (
 	VendorBusinessAssociateAgreementEntityType
 	FileEntityType
 	VendorContactEntityType
+	VendorDataPrivacyAgreementEntityType
 )

pkg/coredata/migrations/20250813T141529Z.sql

@@ -0,0 +1,29 @@
+CREATE TABLE vendor_data_privacy_agreements (
+    id TEXT PRIMARY KEY,
+    organization_id TEXT NOT NULL,
+    tenant_id TEXT NOT NULL,
+    vendor_id TEXT NOT NULL,
+    valid_from DATE,
+    valid_until DATE,
+    file_id TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+
+    CONSTRAINT vendor_data_privacy_agreements_organization_vendor_unique
+        UNIQUE (organization_id, vendor_id),
+
+    CONSTRAINT vendor_data_privacy_agreements_file_id_unique
+        UNIQUE (file_id),
+
+    CONSTRAINT vendor_data_privacy_agreements_organization_id_fkey
+        FOREIGN KEY (organization_id)
+        REFERENCES organizations(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE,
+
+    CONSTRAINT vendor_data_privacy_agreements_file_id_fkey
+        FOREIGN KEY (file_id)
+        REFERENCES files(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE
+);

pkg/coredata/vendor_data_privacy_agreement.go

@@ -0,0 +1,280 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	VendorDataPrivacyAgreement struct {
+		ID             gid.GID      `db:"id"`
+		TenantID       gid.TenantID `db:"tenant_id"`
+		OrganizationID gid.GID      `db:"organization_id"`
+		VendorID       gid.GID      `db:"vendor_id"`
+		ValidFrom      *time.Time   `db:"valid_from"`
+		ValidUntil     *time.Time   `db:"valid_until"`
+		FileID         gid.GID      `db:"file_id"`
+		CreatedAt      time.Time    `db:"created_at"`
+		UpdatedAt      time.Time    `db:"updated_at"`
+	}
+
+	VendorDataPrivacyAgreements []*VendorDataPrivacyAgreement
+)
+
+func (v VendorDataPrivacyAgreement) CursorKey(orderBy VendorDataPrivacyAgreementOrderField) page.CursorKey {
+	switch orderBy {
+	case VendorDataPrivacyAgreementOrderFieldValidFrom:
+		return page.NewCursorKey(v.ID, v.ValidFrom)
+	case VendorDataPrivacyAgreementOrderFieldCreatedAt:
+		return page.NewCursorKey(v.ID, v.CreatedAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (vdpa *VendorDataPrivacyAgreement) LoadByVendorID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	vendor_id,
+	valid_from,
+	valid_until,
+	file_id,
+	created_at,
+	updated_at
+FROM
+	vendor_data_privacy_agreements
+WHERE
+	%s
+	AND vendor_id = @vendor_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"vendor_id": vendorID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query vendor data privacy agreement: %w", err)
+	}
+
+	vendorDataPrivacyAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorDataPrivacyAgreement])
+	if err != nil {
+		return fmt.Errorf("cannot collect vendor data privacy agreement: %w", err)
+	}
+
+	*vdpa = vendorDataPrivacyAgreement
+
+	return nil
+}
+
+func (vdpa *VendorDataPrivacyAgreement) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorDataPrivacyAgreementID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	vendor_id,
+	valid_from,
+	valid_until,
+	file_id,
+	created_at,
+	updated_at
+FROM
+	vendor_data_privacy_agreements
+WHERE
+	%s
+	AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"id": vendorDataPrivacyAgreementID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query vendor data privacy agreement: %w", err)
+	}
+
+	vendorDataPrivacyAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorDataPrivacyAgreement])
+	if err != nil {
+		return fmt.Errorf("cannot collect vendor data privacy agreement: %w", err)
+	}
+
+	*vdpa = vendorDataPrivacyAgreement
+
+	return nil
+}
+
+func (vdpa *VendorDataPrivacyAgreement) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE
+	vendor_data_privacy_agreements
+SET
+	valid_from = @valid_from,
+	valid_until = @valid_until,
+	file_id = @file_id,
+	updated_at = @updated_at
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":          vdpa.ID,
+		"valid_from":  vdpa.ValidFrom,
+		"valid_until": vdpa.ValidUntil,
+		"file_id":     vdpa.FileID,
+		"updated_at":  vdpa.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update vendor data privacy agreement: %w", err)
+	}
+
+	return nil
+}
+
+func (vdpa *VendorDataPrivacyAgreement) Upsert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+	vendor_data_privacy_agreements (
+		id,
+		tenant_id,
+		organization_id,
+		vendor_id,
+		valid_from,
+		valid_until,
+		file_id,
+		created_at,
+		updated_at
+	)
+VALUES (
+	@id,
+	@tenant_id,
+	@organization_id,
+	@vendor_id,
+	@valid_from,
+	@valid_until,
+	@file_id,
+	@created_at,
+	@updated_at
+)
+ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
+	id = EXCLUDED.id,
+	valid_from = EXCLUDED.valid_from,
+	valid_until = EXCLUDED.valid_until,
+	file_id = EXCLUDED.file_id,
+	updated_at = EXCLUDED.updated_at
+`
+	args := pgx.StrictNamedArgs{
+		"id":              vdpa.ID,
+		"tenant_id":       scope.GetTenantID(),
+		"vendor_id":       vdpa.VendorID,
+		"organization_id": vdpa.OrganizationID,
+		"valid_from":      vdpa.ValidFrom,
+		"valid_until":     vdpa.ValidUntil,
+		"file_id":         vdpa.FileID,
+		"created_at":      vdpa.CreatedAt,
+		"updated_at":      vdpa.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (vdpa *VendorDataPrivacyAgreement) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE
+FROM
+	vendor_data_privacy_agreements
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": vdpa.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (vdpa *VendorDataPrivacyAgreement) DeleteByVendorID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorID gid.GID,
+) error {
+	q := `
+DELETE
+FROM
+	vendor_data_privacy_agreements
+WHERE
+	%s
+	AND vendor_id = @vendor_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}

pkg/coredata/vendor_data_privacy_agreement_order_field.go

@@ -0,0 +1,41 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	VendorDataPrivacyAgreementOrderField string
+)
+
+const (
+	VendorDataPrivacyAgreementOrderFieldValidFrom VendorDataPrivacyAgreementOrderField = "VALID_FROM"
+	VendorDataPrivacyAgreementOrderFieldCreatedAt VendorDataPrivacyAgreementOrderField = "CREATED_AT"
+)
+
+func (p VendorDataPrivacyAgreementOrderField) Column() string {
+	return string(p)
+}
+
+func (p VendorDataPrivacyAgreementOrderField) String() string {
+	return string(p)
+}
+
+func (p VendorDataPrivacyAgreementOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *VendorDataPrivacyAgreementOrderField) UnmarshalText(text []byte) error {
+	*p = VendorDataPrivacyAgreementOrderField(text)
+	return nil
+}

pkg/probo/service.go

@@ -73,6 +73,7 @@ type (
 		VendorComplianceReports           *VendorComplianceReportService
 		VendorBusinessAssociateAgreements *VendorBusinessAssociateAgreementService
 		VendorContacts                    *VendorContactService
+		VendorDataPrivacyAgreements       *VendorDataPrivacyAgreementService
 		Connectors                        *ConnectorService
 		Assets                            *AssetService
 		Data                              *DatumService
@@ -161,6 +162,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.VendorComplianceReports = &VendorComplianceReportService{svc: tenantService}
 	tenantService.VendorBusinessAssociateAgreements = &VendorBusinessAssociateAgreementService{svc: tenantService}
 	tenantService.VendorContacts = &VendorContactService{svc: tenantService}
+	tenantService.VendorDataPrivacyAgreements = &VendorDataPrivacyAgreementService{svc: tenantService}
 	tenantService.Connectors = &ConnectorService{svc: tenantService}
 	tenantService.Assets = &AssetService{svc: tenantService}
 	tenantService.Data = &DatumService{svc: tenantService}

pkg/probo/vendor_business_associate_agreement_service.go

@@ -261,10 +261,6 @@ func (s VendorBusinessAssociateAgreementService) Update(
 				return fmt.Errorf("cannot load existing vendor business associate agreement: %w", err)
 			}
 
-			if err := file.LoadByID(ctx, conn, s.svc.scope, existingAgreement.FileID); err != nil {
-				return fmt.Errorf("cannot load file: %w", err)
-			}
-
 			now := time.Now()
 			if req.ValidFrom != nil {
 				existingAgreement.ValidFrom = *req.ValidFrom
@@ -275,14 +271,14 @@ func (s VendorBusinessAssociateAgreementService) Update(
 
 			existingAgreement.UpdatedAt = now
 
-			if err := file.LoadByID(ctx, conn, s.svc.scope, existingAgreement.FileID); err != nil {
-				return fmt.Errorf("cannot load file: %w", err)
-			}
-
 			if err := existingAgreement.Update(ctx, conn, s.svc.scope); err != nil {
 				return fmt.Errorf("cannot update vendor business associate agreement: %w", err)
 			}
 
+			if err := file.LoadByID(ctx, conn, s.svc.scope, existingAgreement.FileID); err != nil {
+				return fmt.Errorf("cannot load file: %w", err)
+			}
+
 			return nil
 		},
 	)

pkg/probo/vendor_data_privacy_agreement_service.go

@@ -0,0 +1,346 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"mime"
+	"net/url"
+	"path/filepath"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"go.gearno.de/crypto/uuid"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	VendorDataPrivacyAgreementService struct {
+		svc *TenantService
+	}
+
+	VendorDataPrivacyAgreementCreateRequest struct {
+		File       io.Reader
+		ValidFrom  *time.Time
+		ValidUntil *time.Time
+		FileName   string
+	}
+
+	VendorDataPrivacyAgreementUpdateRequest struct {
+		ValidFrom  **time.Time
+		ValidUntil **time.Time
+	}
+)
+
+func (s VendorDataPrivacyAgreementService) GetByVendorID(
+	ctx context.Context,
+	vendorID gid.GID,
+) (*coredata.VendorDataPrivacyAgreement, *coredata.File, error) {
+	var vendorDataPrivacyAgreement *coredata.VendorDataPrivacyAgreement
+	var file *coredata.File
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			vendorDataPrivacyAgreement = &coredata.VendorDataPrivacyAgreement{}
+			if err := vendorDataPrivacyAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
+				return fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+			}
+
+			file = &coredata.File{}
+			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreement.FileID); err != nil {
+				return fmt.Errorf("cannot load file: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return vendorDataPrivacyAgreement, file, nil
+}
+
+func (s VendorDataPrivacyAgreementService) Upload(
+	ctx context.Context,
+	vendorID gid.GID,
+	req *VendorDataPrivacyAgreementCreateRequest,
+) (*coredata.VendorDataPrivacyAgreement, *coredata.File, error) {
+	objectKey, err := uuid.NewV7()
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot generate object key: %w", err)
+	}
+
+	mimeType := mime.TypeByExtension(filepath.Ext(req.FileName))
+
+	_, err = s.svc.s3.PutObject(ctx, &s3.PutObjectInput{
+		Bucket:      &s.svc.bucket,
+		Key:         aws.String(objectKey.String()),
+		Body:        req.File,
+		ContentType: &mimeType,
+	})
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot upload file to S3: %w", err)
+	}
+
+	headOutput, err := s.svc.s3.HeadObject(ctx, &s3.HeadObjectInput{
+		Bucket: aws.String(s.svc.bucket),
+		Key:    aws.String(objectKey.String()),
+	})
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot get object metadata: %w", err)
+	}
+
+	now := time.Now()
+
+	fileID := gid.New(s.svc.scope.GetTenantID(), coredata.FileEntityType)
+	vendorDataPrivacyAgreementID := gid.New(s.svc.scope.GetTenantID(), coredata.VendorDataPrivacyAgreementEntityType)
+
+	var vendorDataPrivacyAgreement *coredata.VendorDataPrivacyAgreement
+	var file *coredata.File
+
+	err = s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			vendor := &coredata.Vendor{}
+			if err := vendor.LoadByID(ctx, conn, s.svc.scope, vendorID); err != nil {
+				return fmt.Errorf("cannot load vendor: %w", err)
+			}
+
+			file = &coredata.File{
+				ID:         fileID,
+				BucketName: s.svc.bucket,
+				MimeType:   mimeType,
+				FileName:   req.FileName,
+				FileKey:    objectKey.String(),
+				FileSize:   int(*headOutput.ContentLength),
+				CreatedAt:  now,
+				UpdatedAt:  now,
+			}
+
+			vendorDataPrivacyAgreement = &coredata.VendorDataPrivacyAgreement{
+				ID:             vendorDataPrivacyAgreementID,
+				TenantID:       s.svc.scope.GetTenantID(),
+				OrganizationID: vendor.OrganizationID,
+				VendorID:       vendorID,
+				ValidFrom:      req.ValidFrom,
+				ValidUntil:     req.ValidUntil,
+				FileID:         fileID,
+				CreatedAt:      now,
+				UpdatedAt:      now,
+			}
+
+			if err := file.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert file: %w", err)
+			}
+
+			if err := vendorDataPrivacyAgreement.Upsert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert vendor data privacy agreement: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return vendorDataPrivacyAgreement, file, nil
+}
+
+func (s VendorDataPrivacyAgreementService) Get(
+	ctx context.Context,
+	vendorDataPrivacyAgreementID gid.GID,
+) (*coredata.VendorDataPrivacyAgreement, *coredata.File, error) {
+	var vendorDataPrivacyAgreement *coredata.VendorDataPrivacyAgreement
+	var file *coredata.File
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			vendorDataPrivacyAgreement = &coredata.VendorDataPrivacyAgreement{}
+			if err := vendorDataPrivacyAgreement.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreementID); err != nil {
+				return fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+			}
+
+			file = &coredata.File{}
+			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreement.FileID); err != nil {
+				return fmt.Errorf("cannot load file: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+	}
+
+	return vendorDataPrivacyAgreement, file, nil
+}
+
+func (s VendorDataPrivacyAgreementService) GenerateFileURL(
+	ctx context.Context,
+	vendorDataPrivacyAgreementID gid.GID,
+	expiresIn time.Duration,
+) (string, error) {
+	var file *coredata.File
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			vendorDataPrivacyAgreement := &coredata.VendorDataPrivacyAgreement{}
+			if err := vendorDataPrivacyAgreement.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreementID); err != nil {
+				return fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+			}
+
+			file = &coredata.File{}
+			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreement.FileID); err != nil {
+				return fmt.Errorf("cannot load file: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return "", err
+	}
+
+	presignClient := s3.NewPresignClient(s.svc.s3)
+
+	encodedFilename := url.QueryEscape(file.FileName)
+	contentDisposition := fmt.Sprintf("attachment; filename=\"%s\"; filename*=UTF-8''%s",
+		encodedFilename, encodedFilename)
+
+	presignedReq, err := presignClient.PresignGetObject(ctx, &s3.GetObjectInput{
+		Bucket:                     aws.String(s.svc.bucket),
+		Key:                        aws.String(file.FileKey),
+		ResponseCacheControl:       aws.String("max-age=3600, public"),
+		ResponseContentDisposition: aws.String(contentDisposition),
+	}, func(opts *s3.PresignOptions) {
+		opts.Expires = expiresIn
+	})
+	if err != nil {
+		return "", fmt.Errorf("cannot presign GetObject request: %w", err)
+	}
+
+	return presignedReq.URL, nil
+}
+
+func (s VendorDataPrivacyAgreementService) Update(
+	ctx context.Context,
+	vendorID gid.GID,
+	req *VendorDataPrivacyAgreementUpdateRequest,
+) (*coredata.VendorDataPrivacyAgreement, *coredata.File, error) {
+	existingAgreement := &coredata.VendorDataPrivacyAgreement{}
+	file := &coredata.File{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := existingAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
+				return fmt.Errorf("cannot load existing vendor data privacy agreement: %w", err)
+			}
+
+			now := time.Now()
+			if req.ValidFrom != nil {
+				existingAgreement.ValidFrom = *req.ValidFrom
+			}
+			if req.ValidUntil != nil {
+				existingAgreement.ValidUntil = *req.ValidUntil
+			}
+
+			existingAgreement.UpdatedAt = now
+
+			if err := existingAgreement.Update(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update vendor data privacy agreement: %w", err)
+			}
+
+			if err := file.LoadByID(ctx, conn, s.svc.scope, existingAgreement.FileID); err != nil {
+				return fmt.Errorf("cannot load file: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return existingAgreement, file, nil
+}
+
+func (s VendorDataPrivacyAgreementService) Delete(
+	ctx context.Context,
+	vendorDataPrivacyAgreementID gid.GID,
+) error {
+	return s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			vendorDataPrivacyAgreement := &coredata.VendorDataPrivacyAgreement{}
+			if err := vendorDataPrivacyAgreement.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreementID); err != nil {
+				return fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+			}
+
+			file := &coredata.File{ID: vendorDataPrivacyAgreement.FileID}
+
+			if err := vendorDataPrivacyAgreement.Delete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot delete vendor data privacy agreement: %w", err)
+			}
+
+			if err := file.SoftDelete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot soft delete file: %w", err)
+			}
+
+			return nil
+		},
+	)
+}
+
+func (s VendorDataPrivacyAgreementService) DeleteByVendorID(
+	ctx context.Context,
+	vendorID gid.GID,
+) error {
+	return s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			vendorDataPrivacyAgreement := &coredata.VendorDataPrivacyAgreement{}
+			if err := vendorDataPrivacyAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
+				return fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+			}
+
+			file := &coredata.File{ID: vendorDataPrivacyAgreement.FileID}
+
+			if err := vendorDataPrivacyAgreement.DeleteByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
+				return fmt.Errorf("cannot delete vendor data privacy agreement: %w", err)
+			}
+
+			if err := file.SoftDelete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot soft delete file: %w", err)
+			}
+
+			return nil
+		},
+	)
+}

pkg/server/api/console/v1/schema.graphql

@@ -942,6 +942,7 @@ type Vendor implements Node {
   ): VendorComplianceReportConnection! @goField(forceResolver: true)
 
   businessAssociateAgreement: VendorBusinessAssociateAgreement @goField(forceResolver: true)
+  dataPrivacyAgreement: VendorDataPrivacyAgreement @goField(forceResolver: true)
 
   contacts(
     first: Int
@@ -1015,6 +1016,18 @@ type VendorContact implements Node {
   updatedAt: Datetime!
 }
 
+type VendorDataPrivacyAgreement implements Node {
+  id: ID!
+  vendor: Vendor! @goField(forceResolver: true)
+  validFrom: Datetime
+  validUntil: Datetime
+  fileName: String!
+  fileUrl: String! @goField(forceResolver: true)
+  fileSize: Int!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Framework implements Node {
   id: ID!
   name: String!
@@ -1678,6 +1691,17 @@ type Mutation {
     input: DeleteVendorBusinessAssociateAgreementInput!
   ): DeleteVendorBusinessAssociateAgreementPayload!
 
+  # Vendor Data Privacy Agreement mutations
+  uploadVendorDataPrivacyAgreement(
+    input: UploadVendorDataPrivacyAgreementInput!
+  ): UploadVendorDataPrivacyAgreementPayload!
+  updateVendorDataPrivacyAgreement(
+    input: UpdateVendorDataPrivacyAgreementInput!
+  ): UpdateVendorDataPrivacyAgreementPayload!
+  deleteVendorDataPrivacyAgreement(
+    input: DeleteVendorDataPrivacyAgreementInput!
+  ): DeleteVendorDataPrivacyAgreementPayload!
+
   # Document mutations
   createDocument(input: CreateDocumentInput!): CreateDocumentPayload!
   updateDocument(input: UpdateDocumentInput!): UpdateDocumentPayload!
@@ -2071,6 +2095,24 @@ input DeleteVendorBusinessAssociateAgreementInput {
   vendorId: ID!
 }
 
+input UploadVendorDataPrivacyAgreementInput {
+  vendorId: ID!
+  validFrom: Datetime
+  validUntil: Datetime
+  fileName: String!
+  file: Upload!
+}
+
+input UpdateVendorDataPrivacyAgreementInput {
+  vendorId: ID!
+  validFrom: Datetime
+  validUntil: Datetime
+}
+
+input DeleteVendorDataPrivacyAgreementInput {
+  vendorId: ID!
+}
+
 input CreateDocumentInput {
   organizationId: ID!
   title: String!
@@ -2375,6 +2417,18 @@ type DeleteVendorBusinessAssociateAgreementPayload {
   deletedVendorId: ID!
 }
 
+type UploadVendorDataPrivacyAgreementPayload {
+  vendorDataPrivacyAgreement: VendorDataPrivacyAgreement!
+}
+
+type UpdateVendorDataPrivacyAgreementPayload {
+  vendorDataPrivacyAgreement: VendorDataPrivacyAgreement!
+}
+
+type DeleteVendorDataPrivacyAgreementPayload {
+  deletedVendorId: ID!
+}
+
 type CreateDocumentPayload {
   documentEdge: DocumentEdge!
   documentVersionEdge: DocumentVersionEdge!

pkg/server/api/console/v1/types/types.go

@@ -631,6 +631,14 @@ type DeleteVendorContactPayload struct {
 	DeletedVendorContactID gid.GID `json:"deletedVendorContactId"`
 }
 
+type DeleteVendorDataPrivacyAgreementInput struct {
+	VendorID gid.GID `json:"vendorId"`
+}
+
+type DeleteVendorDataPrivacyAgreementPayload struct {
+	DeletedVendorID gid.GID `json:"deletedVendorId"`
+}
+
 type DeleteVendorInput struct {
 	VendorID gid.GID `json:"vendorId"`
 }
@@ -1306,6 +1314,16 @@ type UpdateVendorContactPayload struct {
 	VendorContact *VendorContact `json:"vendorContact"`
 }
 
+type UpdateVendorDataPrivacyAgreementInput struct {
+	VendorID   gid.GID    `json:"vendorId"`
+	ValidFrom  *time.Time `json:"validFrom,omitempty"`
+	ValidUntil *time.Time `json:"validUntil,omitempty"`
+}
+
+type UpdateVendorDataPrivacyAgreementPayload struct {
+	VendorDataPrivacyAgreement *VendorDataPrivacyAgreement `json:"vendorDataPrivacyAgreement"`
+}
+
 type UpdateVendorInput struct {
 	ID                            gid.GID                  `json:"id"`
 	Name                          *string                  `json:"name,omitempty"`
@@ -1384,6 +1402,18 @@ type UploadVendorComplianceReportPayload struct {
 	VendorComplianceReportEdge *VendorComplianceReportEdge `json:"vendorComplianceReportEdge"`
 }
 
+type UploadVendorDataPrivacyAgreementInput struct {
+	VendorID   gid.GID        `json:"vendorId"`
+	ValidFrom  *time.Time     `json:"validFrom,omitempty"`
+	ValidUntil *time.Time     `json:"validUntil,omitempty"`
+	FileName   string         `json:"fileName"`
+	File       graphql.Upload `json:"file"`
+}
+
+type UploadVendorDataPrivacyAgreementPayload struct {
+	VendorDataPrivacyAgreement *VendorDataPrivacyAgreement `json:"vendorDataPrivacyAgreement"`
+}
+
 type User struct {
 	ID        gid.GID   `json:"id"`
 	FullName  string    `json:"fullName"`
@@ -1414,6 +1444,7 @@ type Vendor struct {
 	Organization                  *Organization                     `json:"organization"`
 	ComplianceReports             *VendorComplianceReportConnection `json:"complianceReports"`
 	BusinessAssociateAgreement    *VendorBusinessAssociateAgreement `json:"businessAssociateAgreement,omitempty"`
+	DataPrivacyAgreement          *VendorDataPrivacyAgreement       `json:"dataPrivacyAgreement,omitempty"`
 	Contacts                      *VendorContactConnection          `json:"contacts"`
 	RiskAssessments               *VendorRiskAssessmentConnection   `json:"riskAssessments"`
 	BusinessOwner                 *People                           `json:"businessOwner,omitempty"`
@@ -1503,6 +1534,21 @@ type VendorContactEdge struct {
 	Node   *VendorContact `json:"node"`
 }
 
+type VendorDataPrivacyAgreement struct {
+	ID         gid.GID    `json:"id"`
+	Vendor     *Vendor    `json:"vendor"`
+	ValidFrom  *time.Time `json:"validFrom,omitempty"`
+	ValidUntil *time.Time `json:"validUntil,omitempty"`
+	FileName   string     `json:"fileName"`
+	FileURL    string     `json:"fileUrl"`
+	FileSize   int        `json:"fileSize"`
+	CreatedAt  time.Time  `json:"createdAt"`
+	UpdatedAt  time.Time  `json:"updatedAt"`
+}
+
+func (VendorDataPrivacyAgreement) IsNode()             {}
+func (this VendorDataPrivacyAgreement) GetID() gid.GID { return this.ID }
+
 type VendorEdge struct {
 	Cursor page.CursorKey `json:"cursor"`
 	Node   *Vendor        `json:"node"`

pkg/server/api/console/v1/types/vendor_data_privacy_agreement.go

@@ -0,0 +1,31 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+)
+
+func NewVendorDataPrivacyAgreement(v *coredata.VendorDataPrivacyAgreement, file *coredata.File) *VendorDataPrivacyAgreement {
+	return &VendorDataPrivacyAgreement{
+		ID:         v.ID,
+		ValidFrom:  v.ValidFrom,
+		ValidUntil: v.ValidUntil,
+		FileName:   file.FileName,
+		FileSize:   file.FileSize,
+		CreatedAt:  v.CreatedAt,
+		UpdatedAt:  v.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/v1_resolver.go

@@ -2022,6 +2022,64 @@ func (r *mutationResolver) DeleteVendorBusinessAssociateAgreement(ctx context.Co
 	}, nil
 }
 
+// UploadVendorDataPrivacyAgreement is the resolver for the uploadVendorDataPrivacyAgreement field.
+func (r *mutationResolver) UploadVendorDataPrivacyAgreement(ctx context.Context, input types.UploadVendorDataPrivacyAgreementInput) (*types.UploadVendorDataPrivacyAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	vendorDataPrivacyAgreement, file, err := prb.VendorDataPrivacyAgreements.Upload(
+		ctx,
+		input.VendorID,
+		&probo.VendorDataPrivacyAgreementCreateRequest{
+			File:       input.File.File,
+			ValidFrom:  input.ValidFrom,
+			ValidUntil: input.ValidUntil,
+			FileName:   input.FileName,
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to upload vendor data privacy agreement: %w", err)
+	}
+
+	return &types.UploadVendorDataPrivacyAgreementPayload{
+		VendorDataPrivacyAgreement: types.NewVendorDataPrivacyAgreement(vendorDataPrivacyAgreement, file),
+	}, nil
+}
+
+// UpdateVendorDataPrivacyAgreement is the resolver for the updateVendorDataPrivacyAgreement field.
+func (r *mutationResolver) UpdateVendorDataPrivacyAgreement(ctx context.Context, input types.UpdateVendorDataPrivacyAgreementInput) (*types.UpdateVendorDataPrivacyAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	vendorDataPrivacyAgreement, file, err := prb.VendorDataPrivacyAgreements.Update(
+		ctx,
+		input.VendorID,
+		&probo.VendorDataPrivacyAgreementUpdateRequest{
+			ValidFrom:  &input.ValidFrom,
+			ValidUntil: &input.ValidUntil,
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to update vendor data privacy agreement: %w", err)
+	}
+
+	return &types.UpdateVendorDataPrivacyAgreementPayload{
+		VendorDataPrivacyAgreement: types.NewVendorDataPrivacyAgreement(vendorDataPrivacyAgreement, file),
+	}, nil
+}
+
+// DeleteVendorDataPrivacyAgreement is the resolver for the deleteVendorDataPrivacyAgreement field.
+func (r *mutationResolver) DeleteVendorDataPrivacyAgreement(ctx context.Context, input types.DeleteVendorDataPrivacyAgreementInput) (*types.DeleteVendorDataPrivacyAgreementPayload, error) {
+	prb := r.ProboService(ctx, input.VendorID.TenantID())
+
+	err := prb.VendorDataPrivacyAgreements.DeleteByVendorID(ctx, input.VendorID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to delete vendor data privacy agreement: %w", err)
+	}
+
+	return &types.DeleteVendorDataPrivacyAgreementPayload{
+		DeletedVendorID: input.VendorID,
+	}, nil
+}
+
 // CreateDocument is the resolver for the createDocument field.
 func (r *mutationResolver) CreateDocument(ctx context.Context, input types.CreateDocumentInput) (*types.CreateDocumentPayload, error) {
 	prb := r.ProboService(ctx, input.OrganizationID.TenantID())
@@ -3469,6 +3527,22 @@ func (r *vendorResolver) BusinessAssociateAgreement(ctx context.Context, obj *ty
 	return types.NewVendorBusinessAssociateAgreement(vendorBusinessAssociateAgreement, file), nil
 }
 
+// DataPrivacyAgreement is the resolver for the dataPrivacyAgreement field.
+func (r *vendorResolver) DataPrivacyAgreement(ctx context.Context, obj *types.Vendor) (*types.VendorDataPrivacyAgreement, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	vendorDataPrivacyAgreement, file, err := prb.VendorDataPrivacyAgreements.GetByVendorID(ctx, obj.ID)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+
+		return nil, fmt.Errorf("failed to get vendor data privacy agreement: %w", err)
+	}
+
+	return types.NewVendorDataPrivacyAgreement(vendorDataPrivacyAgreement, file), nil
+}
+
 // Contacts is the resolver for the contacts field.
 func (r *vendorResolver) Contacts(ctx context.Context, obj *types.Vendor, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorContactOrderBy) (*types.VendorContactConnection, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -3654,6 +3728,30 @@ func (r *vendorContactResolver) Vendor(ctx context.Context, obj *types.VendorCon
 	return types.NewVendor(vendor), nil
 }
 
+// Vendor is the resolver for the vendor field.
+func (r *vendorDataPrivacyAgreementResolver) Vendor(ctx context.Context, obj *types.VendorDataPrivacyAgreement) (*types.Vendor, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	vendor, err := prb.Vendors.Get(ctx, obj.ID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get vendor: %w", err)
+	}
+
+	return types.NewVendor(vendor), nil
+}
+
+// FileURL is the resolver for the fileUrl field.
+func (r *vendorDataPrivacyAgreementResolver) FileURL(ctx context.Context, obj *types.VendorDataPrivacyAgreement) (string, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	fileURL, err := prb.VendorDataPrivacyAgreements.GenerateFileURL(ctx, obj.ID, 1*time.Hour)
+	if err != nil {
+		return "", fmt.Errorf("failed to generate file URL: %w", err)
+	}
+
+	return fileURL, nil
+}
+
 // Vendor is the resolver for the vendor field.
 func (r *vendorRiskAssessmentResolver) Vendor(ctx context.Context, obj *types.VendorRiskAssessment) (*types.Vendor, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -3838,6 +3936,11 @@ func (r *Resolver) VendorConnection() schema.VendorConnectionResolver {
 // VendorContact returns schema.VendorContactResolver implementation.
 func (r *Resolver) VendorContact() schema.VendorContactResolver { return &vendorContactResolver{r} }
 
+// VendorDataPrivacyAgreement returns schema.VendorDataPrivacyAgreementResolver implementation.
+func (r *Resolver) VendorDataPrivacyAgreement() schema.VendorDataPrivacyAgreementResolver {
+	return &vendorDataPrivacyAgreementResolver{r}
+}
+
 // VendorRiskAssessment returns schema.VendorRiskAssessmentResolver implementation.
 func (r *Resolver) VendorRiskAssessment() schema.VendorRiskAssessmentResolver {
 	return &vendorRiskAssessmentResolver{r}
@@ -3880,5 +3983,6 @@ type vendorBusinessAssociateAgreementResolver struct{ *Resolver }
 type vendorComplianceReportResolver struct{ *Resolver }
 type vendorConnectionResolver struct{ *Resolver }
 type vendorContactResolver struct{ *Resolver }
+type vendorDataPrivacyAgreementResolver struct{ *Resolver }
 type vendorRiskAssessmentResolver struct{ *Resolver }
 type viewerResolver struct{ *Resolver }