data processing agreement dpa template

Data Processing Addendum

Instructions for Use

• Complete all bracketed information, ensuring the legal entity names match those in your primary Master Services Agreement.
• Define the specific nature and purpose of the processing in the "Scope of Processing" section to ensure regulatory compliance.
• Review the security measures in Exhibit A and append any specific technical documentation required by your organization's IT security policy.

Parties and Definitions

This Data Processing Addendum ("DPA") is entered into by and between: Data Controller: [Controller Full Legal Name], with its principal place of business at [Controller Address] ("Controller"). Data Processor: [Processor Full Legal Name], with its principal place of business at [Processor Address] ("Processor").

Definitions:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Applicable Data Protection Laws" means all applicable laws and regulations relating to the processing of personal data, including the GDPR, CCPA, or other relevant local statutes.
• "Services" means the services provided by Processor to Controller as defined in the [Name of Primary Agreement].

Operative Terms

1. Scope of Processing: Processor shall process Personal Data only for the purpose of providing the Services and in accordance with the documented instructions of the Controller.
2. Data Subject Rights: Processor shall provide reasonable assistance to Controller to enable Controller to respond to requests from data subjects exercising their rights under Applicable Data Protection Laws.
3. Personnel: Processor shall ensure that its personnel engaged in the processing of Personal Data are informed of the confidential nature of the data and have committed themselves to confidentiality.
4. Security Measures: Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as detailed in Exhibit A.
5. Sub-processors: Processor shall not engage any sub-processor without prior written authorization from Controller. Processor shall remain fully liable for the acts and omissions of its sub-processors.
6. Data Breach Notification: Processor shall notify Controller without undue delay after becoming aware of any Personal Data Breach and provide sufficient information to allow Controller to meet any breach notification obligations.
7. Return or Deletion: Upon termination of the Services, Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller, unless applicable law requires storage of the Personal Data.
8. Audits: Processor shall make available to Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits conducted by the Controller or an auditor mandated by the Controller.

Signature & Acknowledgment

For Controller: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

For Processor: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Legal Disclaimer

This document is a general framework intended for informational purposes. It does not constitute legal advice. You must consult with qualified legal counsel to ensure this agreement complies with the specific requirements of your jurisdiction and industry.