data processing agreement template eu

Data Processing Agreement

Instructions for Use

• Complete all bracketed fields with the specific legal details of the Controller and the Processor.
• Ensure that the "Description of Processing" in Annex A accurately reflects the actual data types and purposes of the engagement to satisfy GDPR accountability requirements.
• Have both parties sign and date the document before any personal data is transferred or processed to ensure compliance with Article 28 of the GDPR.

1. Parties and Definitions

This Data Processing Agreement (“DPA”) is entered into as of [Date] (the “Effective Date”) by and between:

Controller: [Full Legal Name of Controller], a company organized under the laws of [Jurisdiction], with its principal place of business at [Full Address] (“Controller”).

Processor: [Full Legal Name of Processor], a company organized under the laws of [Jurisdiction], with its principal place of business at [Full Address] (“Processor”).

Definitions:

• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.
• "Personal Data," "Data Subject," "Processing," and "Supervisory Authority" shall have the meanings ascribed to them in the GDPR.

2. Operative Clauses

1. Scope and Purpose: The Processor shall process Personal Data only on behalf of the Controller and in accordance with the documented instructions of the Controller, including with regard to transfers of personal data to a third country.

2. Confidentiality: The Processor shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3. Security of Processing: Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, the Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

4. Sub-processing: The Processor shall not engage another processor without prior specific or general written authorization of the Controller. The Processor shall ensure that the same data protection obligations as set out in this DPA are imposed on that sub-processor.

5. Data Subject Rights: The Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising the Data Subject’s rights.

6. Audit Rights: The Processor shall make available to the Controller all information necessary to demonstrate compliance with Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

7. Termination: Upon the end of the provision of services, the Processor shall, at the choice of the Controller, delete or return all the Personal Data to the Controller and delete existing copies unless Union or Member State law requires storage of the Personal Data.

3. Annex A: Description of Processing

• Subject Matter: [Describe the nature of the service provided]
• Duration: [Duration of the agreement or "Until termination of the services"]
• Nature and Purpose: [Describe why the data is being processed]
• Types of Personal Data: [e.g., Names, Email Addresses, IP Addresses]
• Categories of Data Subjects: [e.g., Employees, Customers, End-users]

4. Signature and Acknowledgment

Controller Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Processor Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Legal Disclaimer

This document is a general framework provided for informational purposes only. It does not constitute legal advice. Laws regarding data protection vary by jurisdiction and specific business context; you must consult with qualified legal counsel to ensure this agreement satisfies your specific compliance obligations under the GDPR and other applicable local laws.