data processing agreement example

Data Processing Agreement

Instructions for Use

• Complete all bracketed fields to accurately reflect the identities and specific data handling roles of both the Controller and the Processor.
• Review the scope of processing in Section 2 to ensure it aligns precisely with the services provided under your primary Master Services Agreement.
• Ensure that the technical and organizational security measures described in the Appendix are audited by your IT security team before finalizing this document.

1. Parties and Definitions

This Data Processing Agreement ("DPA") is entered into by and between:

Controller: [Full Legal Name of Controller], located at [Controller Address] ("Controller").

Processor: [Full Legal Name of Processor], located at [Processor Address] ("Processor").

Definitions:

• "Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data, including the GDPR, CCPA/CPRA, or other relevant regional privacy statutes.
• "Personal Data" means any information relating to an identified or identifiable natural person provided by the Controller to the Processor.
• "Processing" means any operation performed on Personal Data, such as collection, storage, retrieval, or destruction.

2. Scope and Purpose

The Processor shall process Personal Data only for the purpose of providing [Description of Services] to the Controller as outlined in the [Name of Primary Agreement]. The Processor shall not process Personal Data for any other purpose unless documented instructions are provided by the Controller.

3. Obligations of the Processor

The Processor agrees to:

1. Process Personal Data only on documented instructions from the Controller.
2. Ensure that persons authorized to process the Personal Data have committed themselves to confidentiality.
3. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption and regular testing of systems.
4. Notify the Controller without undue delay after becoming aware of a personal data breach.
5. Assist the Controller in responding to requests from data subjects exercising their rights under applicable Data Protection Laws.
6. Delete or return all Personal Data to the Controller after the end of the provision of services, unless applicable law requires storage of the data.

4. Sub-processing

The Processor shall not engage another processor without prior specific or general written authorization of the Controller. The Processor shall ensure that any sub-processor is bound by data protection obligations at least as restrictive as those set forth in this DPA.

5. International Transfers

If the Processor transfers Personal Data to a third country, the Processor shall ensure such transfer complies with the requirements of applicable Data Protection Laws, including, where necessary, the execution of Standard Contractual Clauses or other approved transfer mechanisms.

6. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

7. Signature and Acknowledgment

Controller Signature: __________ Printed Name: [Name of Signatory] Title: [Title] Date: [Date]

Processor Signature: __________ Printed Name: [Name of Signatory] Title: [Title] Date: [Date]

Legal Disclaimer: This document is a general framework and does not constitute formal legal advice. Privacy regulations vary significantly by jurisdiction and industry. Consult with qualified legal counsel to ensure your specific data processing activities comply with all applicable local and international laws.