data processing agreement template usa

Data Processing Addendum

Instructions for Use

• Complete all bracketed fields to accurately reflect the identities and specific data activities of the Controller and Processor.
• Review the "Technical and Organizational Measures" section to ensure it aligns with the actual security protocols currently implemented by your organization.
• Execute this document as an addendum to your existing Master Services Agreement or primary commercial contract to ensure it is legally binding upon both parties.

Parties and Definitions

This Data Processing Addendum (“DPA”) is entered into by and between:

Controller: [Full Legal Name of Controller], with its principal place of business at [Full Address of Controller] (“Controller”).

Processor: [Full Legal Name of Processor], with its principal place of business at [Full Address of Processor] (“Processor”).

Definitions:

1. "Personal Data" means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller.
2. "Applicable Data Protection Laws" means all applicable federal, state, and local laws, regulations, and ordinances governing the privacy and security of Personal Data, including but not limited to the CCPA/CPRA, VCDPA, and other state-level privacy statutes as applicable.

Operative Terms

1. Scope and Role: The Processor agrees to process Personal Data only for the purpose of providing the services set forth in the [Name of Primary Agreement/Statement of Work], and only in accordance with the documented instructions of the Controller.
2. Data Subject Rights: Processor shall provide reasonable assistance to the Controller to enable the Controller to respond to requests from data subjects exercising their rights under Applicable Data Protection Laws.
3. Personnel Security: Processor shall ensure that its employees, agents, and contractors authorized to process Personal Data are subject to written confidentiality obligations and have received appropriate training regarding the handling of Personal Data.
4. Sub-processors: Processor shall not engage any third-party sub-processor without prior written authorization from the Controller. Processor shall ensure that any sub-processor is bound by written terms that provide at least the same level of protection for Personal Data as those set forth in this DPA.
5. Security Measures: Processor shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
6. Data Breach Notification: Processor shall notify the Controller without undue delay, and in no event later than [Number] hours, after becoming aware of any unauthorized access, acquisition, or disclosure of Personal Data.
7. Return or Deletion: Upon termination of the services, Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller, unless applicable law requires the continued storage of such data.
8. Audit Rights: Upon reasonable notice, Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set forth in this DPA and allow for audits conducted by the Controller or an auditor mandated by the Controller.

Signature and Acknowledgment

Controller Signature: __________ Printed Name: [Name of Signatory] Title: [Title of Signatory] Date: [Date]

Processor Signature: __________ Printed Name: [Name of Signatory] Title: [Title of Signatory] Date: [Date]

Legal Disclaimer: This document is a general framework intended for informational purposes. It does not constitute legal advice. Laws regarding data privacy vary significantly by jurisdiction and industry. You must consult with qualified legal counsel to ensure this document meets all specific regulatory requirements applicable to your business operations.