data processing agreement template word

Data Processing Agreement

Instructions for Use

• Complete all bracketed fields to accurately reflect the identities of the parties and the specific nature of the data processing activities.
• Ensure the "Description of Processing" section is updated to reflect the specific types of personal data and categories of data subjects involved in your business relationship.
• Review the document against the specific data protection laws applicable to your jurisdiction (e.g., GDPR, CCPA/CPRA, etc.) to ensure all mandatory regulatory requirements are addressed.

1. Parties and Definitions

This Data Processing Agreement (“Agreement”) is entered into as of [Date] (the “Effective Date”) by and between:

Controller: [Full Legal Name of Controller], with its principal place of business at [Full Address of Controller] (“Controller”).

Processor: [Full Legal Name of Processor], with its principal place of business at [Full Address of Processor] (“Processor”).

Definitions:

• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Data Protection Laws” means all applicable local, state, and federal laws governing the processing of Personal Data.
• “Services” means the services provided by Processor to Controller as defined in the [Name of Master Services Agreement].

2. Processing of Personal Data

2.1 Scope. Processor shall process Personal Data only as necessary to perform the Services and in accordance with the documented instructions of the Controller. 2.2 Compliance. Processor shall comply with all applicable Data Protection Laws. 2.3 Purpose. Processor is prohibited from processing Personal Data for any purpose other than the performance of the Services.

3. Data Security

3.1 Technical and Organizational Measures. Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and regular testing of security measures. 3.2 Personnel. Processor shall ensure that its employees, agents, and contractors are subject to binding confidentiality obligations regarding the Personal Data.

4. Sub-processing

4.1 Authorization. Processor shall not appoint a third-party sub-processor without the prior written authorization of the Controller. 4.2 Liability. Processor shall remain fully liable for the acts and omissions of any sub-processor as if they were the acts or omissions of the Processor.

5. Data Subject Rights

5.1 Assistance. Processor shall provide reasonable assistance to the Controller to enable the Controller to respond to requests from data subjects exercising their rights under Data Protection Laws.

6. Breach Notification

6.1 Notification. Processor shall notify Controller without undue delay upon becoming aware of any unauthorized or accidental access, loss, or disclosure of Personal Data.

7. Termination

7.1 Return or Deletion. Upon termination of the Services, Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller, unless applicable law requires continued storage.

Signature & Acknowledgment

Controller: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Processor: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Legal Disclaimer: This document is a general framework and does not constitute legal advice. You must consult with qualified legal counsel to ensure this agreement satisfies the specific regulatory requirements of your jurisdiction and industry.