data processing agreement template eu commission

Data Processing Agreement

Instructions for Use

• Complete all bracketed fields with the legal details of the Controller and Processor.
• Review the Annexes to ensure the specific categories of personal data and processing activities are accurately described.
• Ensure both parties sign the document; the agreement is only effective once executed by authorized signatories of both organizations.

Parties and Definitions

This Data Processing Agreement ("DPA") is entered into by and between: Controller: [Full Legal Name of Controller], with its principal place of business at [Full Business Address] ("Controller"). Processor: [Full Legal Name of Processor], with its principal place of business at [Full Business Address] ("Processor").

"Data Protection Laws" means the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any applicable national implementing legislation.

Operative Clauses

1. Scope and Purpose: The Processor shall process personal data only on behalf of the Controller and in accordance with the documented instructions of the Controller, including with regard to transfers of personal data to a third country.
2. Confidentiality: The Processor shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Security of Processing: Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, the Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
4. Sub-processors: The Processor shall not engage another processor without prior specific or general written authorization of the Controller. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of other processors.
5. Data Subject Rights: Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the data subject's rights.
6. Assistance: The Processor shall assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to the Processor.
7. Termination: At the choice of the Controller, the Processor shall delete or return all the personal data to the Controller after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the personal data.
8. Audit Rights: The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

Signature and Acknowledgment

By signing below, the parties agree to the terms of this DPA.

For Controller: Signature: __________ Printed Name: [Name of Signatory] Title: [Title of Signatory] Date: [Date]

For Processor: Signature: __________ Printed Name: [Name of Signatory] Title: [Title of Signatory] Date: [Date]

Legal Disclaimer: This document is a general framework intended for informational purposes. It does not constitute legal advice. Please consult with qualified legal counsel to ensure compliance with specific jurisdictional requirements and your unique business operations.