data processing agreement template gdpr

Data Processing Addendum

Instructions for Use

• Fill in all bracketed fields with the specific details of your organization and the service provider.
• Ensure the "Nature and Purpose of Processing" section accurately reflects the actual technical activities performed by the processor.
• Have both parties sign and date the document, ensuring it is attached to or incorporated by reference into your primary Master Services Agreement.

Parties and Definitions

This Data Processing Addendum ("Addendum") is entered into by and between:

Controller: [Controller Company Name], a company organized under the laws of [Jurisdiction], with its principal place of business at [Controller Address] ("Controller").

Processor: [Processor Company Name], a company organized under the laws of [Jurisdiction], with its principal place of business at [Processor Address] ("Processor").

The Controller and Processor are collectively referred to as the "Parties."

1. Scope and Purpose

The Processor shall process Personal Data only for the purpose of providing the services described in the [Name of Primary Service Agreement] dated [Date of Agreement]. The duration of processing shall be for the term of the agreement, or until the termination of services.

2. Obligations of the Processor

The Processor agrees to:

• 2.1 Process Personal Data only on documented instructions from the Controller.
• 2.2 Ensure that persons authorized to process the Personal Data have committed themselves to confidentiality.
• 2.3 Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
• 2.4 Not engage another processor without prior specific or general written authorization of the Controller.
• 2.5 Assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the data subject's rights.
• 2.6 Assist the Controller in ensuring compliance with obligations pursuant to Articles 32 to 36 of the GDPR.
• 2.7 At the choice of the Controller, delete or return all the Personal Data to the Controller after the end of the provision of services.
• 2.8 Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Article.

3. Data Transfers

The Processor shall not transfer Personal Data to a country outside the European Economic Area (EEA) or an international organization unless such transfer is compliant with Chapter V of the GDPR (e.g., via Standard Contractual Clauses or an Adequacy Decision).

4. Security Measures

The Processor shall implement the following measures: [ ] Encryption of Personal Data [ ] Regular testing/assessment of security effectiveness [ ] Access control and authentication protocols [ ] [Other specific measures: __________]

5. Breach Notification

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach. Such notification shall include, at a minimum, the nature of the breach, the categories of data affected, and the measures taken to mitigate the impact.

Signature and Acknowledgment

For the Controller: Signature: __________ Printed Name: [Full Name] Title: [Job Title] Date: [Date]

For the Processor: Signature: __________ Printed Name: [Full Name] Title: [Job Title] Date: [Date]

Legal Disclaimer

This document is a general framework provided for informational purposes only. It does not constitute legal advice. Laws regarding data protection vary by jurisdiction and industry. You must consult with qualified legal counsel to ensure this document meets your specific compliance requirements under applicable laws.