A data processing apparatus includes a first limit unit, an acquisition unit, a registration unit, and a second limit unit. If user authentication has been performed for a user by using acquired account information, the first limit unit limits a service to be provided, in accordance with a use limit that is preset for each of authenticated users. If the user authentication has not been performed for the user, the acquisition unit acquires biological information of the user. The registration unit registers the acquired biological information and a use status of the service in association with each other in a database. The second limit unit limits the service to be provided, in accordance with the use status corresponding to the acquired biological information.