data processing agreement template european commission

Data Processing Agreement

Instructions for Use

• Complete all bracketed fields to accurately reflect the roles and responsibilities of the parties involved in the data processing arrangement.
• Ensure that the "Subject Matter and Duration" section is specific to the actual services being provided to maintain compliance with GDPR transparency requirements.
• Once finalized, both parties must sign and date the document; maintain a copy in your records for audit purposes as required by Article 28 of the GDPR.

Parties and Definitions

This Data Processing Agreement ("DPA") is entered into by and between:

Controller: [Full Legal Name of Controller], with its principal place of business at [Full Address of Controller] ("Controller").

Processor: [Full Legal Name of Processor], with its principal place of business at [Full Address of Processor] ("Processor").

Definitions:

1. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.
2. "Personal Data," "Data Subject," "Processing," and "Supervisory Authority" shall have the meanings ascribed to them in the GDPR.
3. "Services" refers to the services provided by the Processor to the Controller as defined in [Reference to Main Service Agreement].

Operative Terms

1. Scope and Purpose: The Processor shall process Personal Data only on behalf of the Controller and in accordance with the documented instructions of the Controller, including with regard to transfers of personal data to a third country.

2. Duration: The processing shall continue for the duration of the agreement between the parties, terminating on [Date or Event].

3. Nature and Purpose of Processing: The Processor is engaged to provide the following services: [Describe services]. The categories of Data Subjects are: [e.g., Employees, Customers]. The types of Personal Data processed are: [e.g., Contact details, Financial data].

4. Confidentiality: The Processor ensures that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5. Security of Processing: The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR.

6. Sub-processors: The Processor shall not engage another processor without prior specific or general written authorization of the Controller. The Processor currently utilizes the following sub-processors: [List Sub-processors or state "None"].

7. Data Subject Rights: The Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the Data Subject's rights.

8. Audit Rights: The Processor shall make available to the Controller all information necessary to demonstrate compliance with Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

9. Termination: Upon the end of the provision of services, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller and delete existing copies unless Union or Member State law requires storage.

Signature and Acknowledgment

For the Controller: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

For the Processor: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Legal Disclaimer: This document is a general framework intended for informational purposes. It does not constitute legal advice. You must consult with qualified legal counsel to ensure this agreement complies with the specific requirements of your jurisdiction and your unique business operations.