data processing agreement template us

Data Processing Agreement

Instructions for Use

• Review the definitions section carefully to ensure the scope of "Personal Information" aligns with your specific industry and applicable state regulations (e.g., CCPA, VCDPA).
• Complete all bracketed fields, ensuring that the description of the "Services" in Section 1 matches the primary commercial agreement between the parties.
• Execute this document as an addendum to your existing Master Services Agreement or vendor contract to ensure it is legally binding and enforceable.

Parties and Definitions

This Data Processing Agreement (“DPA”) is entered into by and between: Data Controller: [Full Legal Name of Controller], with its principal place of business at [Full Address] (“Controller”). Data Processor: [Full Legal Name of Processor], with its principal place of business at [Full Address] (“Processor”).

Definitions:

• "Personal Information" means information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual or household, as defined by applicable law.
• "Services" means the services provided by Processor to Controller as described in [Name of Underlying Agreement].
• "Security Incident" means any unauthorized access, acquisition, destruction, or disclosure of Personal Information.

Operative Terms

1. Scope of Processing. Processor shall process Personal Information only to the extent necessary to perform the Services and in accordance with the documented instructions of the Controller.
2. Compliance with Laws. Processor shall comply with all applicable U.S. federal and state privacy laws, including but not limited to the California Consumer Privacy Act (CCPA) and subsequent amendments.
3. Prohibited Acts. Processor is prohibited from: (a) selling Personal Information; (b) retaining, using, or disclosing Personal Information for any purpose other than the specific purpose of performing the Services; and (c) combining Personal Information received from Controller with data received from other sources, except as permitted by law.
4. Security Measures. Processor shall implement and maintain reasonable administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Personal Information.
5. Sub-processors. Processor shall not engage any sub-processor without the prior written consent of Controller. Processor shall ensure that any authorized sub-processor is bound by written obligations at least as protective as those set forth in this DPA.
6. Security Incidents. Processor shall notify Controller without undue delay, and in no event later than [Number] hours, upon becoming aware of a Security Incident.
7. Return or Deletion. Upon termination of the Services, Processor shall, at the choice of Controller, delete or return all Personal Information, unless applicable law requires continued storage.
8. Audit Rights. Upon reasonable notice, Processor shall make available to Controller such information as is necessary to demonstrate compliance with this DPA and allow for audits conducted by Controller or an independent auditor.

Signature and Acknowledgment

By signing below, the parties agree to be bound by the terms of this DPA.

Controller: Signature: __________ Printed Name: [Name of Signatory] Title: [Title] Date: [Date]

Processor: Signature: __________ Printed Name: [Name of Signatory] Title: [Title] Date: [Date]

Legal Disclaimer: This document is a general framework and does not constitute formal legal advice. Privacy laws vary significantly by jurisdiction; consult with qualified legal counsel to ensure compliance with specific state and federal requirements relevant to your business operations.