data processing agreement templates

Data Processing Addendum

Instructions for Use

• Fill in all bracketed fields with the specific legal names, addresses, and jurisdictional details relevant to your organization and the service provider.
• Review the scope of services in the "Description of Processing" section to ensure it accurately reflects the specific types of personal data being handled.
• Have authorized signatories from both the Controller and the Processor sign and date the document before data transfer commences.

Parties & Definitions

This Data Processing Addendum ("DPA") is entered into by and between:

Controller: [Full Legal Name of Controller], located at [Controller Address] ("Controller").

Processor: [Full Legal Name of Processor], located at [Processor Address] ("Processor").

Definitions:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Data Protection Laws" means all applicable privacy and security laws, including [Insert Applicable Law, e.g., GDPR, CCPA/CPRA].
• "Services" means the services provided by the Processor to the Controller pursuant to the [Name of Master Service Agreement].

Operative Clauses

1. Scope and Role: The Processor shall process Personal Data only on behalf of the Controller and in accordance with the Controller’s documented instructions. The Processor acts as a "Service Provider" or "Processor" as defined by applicable Data Protection Laws.

2. Nature of Processing:

   • Subject Matter: [Describe the nature of the data processing].
   • Duration: [Specify duration of processing].
   • Categories of Data: [List categories, e.g., contact info, financial data, health records].
   • Categories of Data Subjects: [e.g., employees, customers, end-users].

3. Processor Obligations:

   • Confidentiality: Processor ensures that persons authorized to process the Personal Data have committed themselves to confidentiality.
   • Security: Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption and regular testing of security effectiveness.
   • Sub-processors: Processor shall not engage another processor without prior specific or general written authorization of the Controller.

4. Data Subject Rights: Processor shall provide reasonable assistance to the Controller by appropriate technical and organizational measures for the fulfillment of the Controller’s obligation to respond to requests for exercising Data Subject rights.

5. Breach Notification: Processor shall notify the Controller without undue delay after becoming aware of a Personal Data Breach.

6. Deletion or Return: Upon termination of the Services, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller, unless applicable law requires continued storage.

7. Audit Rights: Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by the Controller.

Signature & Acknowledgment

Controller Signature: __________ Printed Name: [Name of Signatory] Title: [Title of Signatory] Date: [__________]

Processor Signature: __________ Printed Name: [Name of Signatory] Title: [Title of Signatory] Date: [__________]

Legal Disclaimer

This document is a general framework intended for informational purposes. It does not constitute legal advice. Please consult with qualified legal counsel to ensure this document complies with the specific requirements of your jurisdiction and industry.