data processing agreement template pdf

Data Processing Addendum

Instructions for Use

• Complete all bracketed fields with the specific legal information for your organization and your service provider.
• Ensure that the "Details of Processing" section accurately reflects the specific categories of data and the purposes for which the data is being handled.
• Once finalized, have authorized signatories from both parties sign the document and retain a copy with your master service agreement or contract records.

1. Parties and Definitions

This Data Processing Addendum ("DPA") is entered into by and between:

Controller: [Company Name], a [State/Country] corporation with its principal place of business at [Full Address] ("Controller").

Processor: [Company Name], a [State/Country] corporation with its principal place of business at [Full Address] ("Processor").

Definitions:

• "Data Protection Laws" means all applicable laws and regulations relating to the processing of personal data, including the GDPR, CCPA, or other relevant regional privacy frameworks.
• "Personal Data" means any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller.

2. Operative Terms

1. Scope and Role: The Processor shall process Personal Data only on behalf of the Controller and in accordance with the documented instructions of the Controller.

2. Processor Obligations:

• The Processor shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality.
• The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
• The Processor shall not engage another processor without prior specific or general written authorization of the Controller.

3. Data Subject Rights: The Processor shall, to the extent legally permitted, notify the Controller if it receives a request from a data subject to exercise their rights under Data Protection Laws and shall provide reasonable assistance to the Controller in responding to such requests.

4. Breach Notification: The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach.

5. Audit Rights: The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

6. Deletion or Return: Upon termination of the services, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller, unless applicable law requires storage of the Personal Data.

3. Details of Processing

• Subject Matter: [Description of subject matter]
• Duration: [Duration of processing]
• Nature and Purpose: [Description of processing activities]
• Categories of Data Subjects: [List categories, e.g., employees, customers]
• Types of Personal Data: [List types, e.g., contact info, financial data]

4. Signature & Acknowledgment

For Controller: Signature: __________ Printed Name: [Full Legal Name] Title: [Job Title] Date: [Date]

For Processor: Signature: __________ Printed Name: [Full Legal Name] Title: [Job Title] Date: [Date]

Legal Disclaimer: This document is a general framework intended for informational purposes. It does not constitute legal advice. You must consult with qualified legal counsel to ensure this document meets the specific regulatory requirements of your jurisdiction and industry.