data processing agreement generator

Data Processing Addendum

Instructions for Use

• Fill in all bracketed information below to accurately reflect the roles and responsibilities of the Controller and the Processor.
• Ensure the "Description of Processing" section is completed with specific details regarding the nature, duration, and purpose of the data operations.
• Once completed, have an authorized representative from both parties sign and date the document to execute the agreement.

1. Parties and Definitions

This Data Processing Addendum ("DPA") is entered into by and between:

Controller: [Controller Full Legal Name], with its principal place of business at [Controller Address] ("Controller").

Processor: [Processor Full Legal Name], with its principal place of business at [Processor Address] ("Processor").

Definitions:

• "Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data, including but not limited to the GDPR, CCPA/CPRA, or other equivalent frameworks.
• "Personal Data" means any information relating to an identified or identifiable natural person provided by the Controller to the Processor.
• "Processing" means any operation or set of operations performed on Personal Data, such as collection, recording, organization, structuring, storage, adaptation, or alteration.

2. Operative Clauses

1. Scope of Processing: The Processor shall process Personal Data only on behalf of the Controller and in accordance with the Controller’s documented instructions. The Processor shall not process Personal Data for any other purpose.
2. Confidentiality: The Processor shall ensure that all persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Security Measures: The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, pseudonymization, and the ability to ensure ongoing confidentiality, integrity, and availability of processing systems.
4. Sub-processors: The Processor shall not engage another processor without prior specific or general written authorization of the Controller. The Processor remains fully liable to the Controller for the performance of any sub-processor's obligations.
5. Data Subject Rights: Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the data subject's rights.
6. Data Breach Notification: The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach.
7. Deletion or Return of Data: Upon termination of the services, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller and delete existing copies unless applicable law requires storage of the data.
8. Audit Rights: The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

3. Description of Processing

• Subject Matter: [Describe the subject matter]
• Duration: [Describe the duration of the processing]
• Nature and Purpose: [Describe the nature and purpose of the processing]
• Types of Personal Data: [List types of data, e.g., names, emails, IP addresses]
• Categories of Data Subjects: [List categories, e.g., customers, employees]

4. Signature and Acknowledgment

By signing below, the parties agree to the terms of this DPA.

For Controller: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

For Processor: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Legal Disclaimer: This document is a general framework and does not constitute legal advice. Data protection regulations vary significantly by jurisdiction. Consult with qualified legal counsel to ensure this agreement satisfies your specific compliance requirements.