edpb data processing agreement template

Data Processing Agreement

Instructions for Use

• Complete all bracketed fields with the specific legal names, addresses, and operational details of the Controller and Processor.
• Review the Annexes to ensure the specific nature, scope, and duration of the processing activities are accurately described.
• Ensure both parties have authorized signatories sign the document and retain a copy for your compliance records to satisfy accountability requirements under GDPR Article 28.

1. Parties and Definitions

This Data Processing Agreement ("DPA") is entered into by and between:

Controller: [Full Legal Name of Controller], located at [Controller Address] ("Controller").

Processor: [Full Legal Name of Processor], located at [Processor Address] ("Processor").

Definitions:

• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.
• "Personal Data," "Data Subject," "Processing," and "Controller/Processor" shall have the same meaning as defined in Article 4 of the GDPR.

2. Nature of Processing

The Processor shall process Personal Data only on behalf of the Controller and in accordance with the documented instructions of the Controller, including with regard to transfers of personal data to a third country or an international organization. The subject matter, duration, nature, and purpose of the processing are detailed in Annex A.

3. Obligations of the Processor

• Confidentiality: The Processor shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Security: The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR.
• Sub-processors: The Processor shall not engage another processor without prior specific or general written authorization of the Controller.
• Data Subject Rights: Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the Data Subject's rights.
• Assistance: The Processor shall assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to the Processor.
• Deletion/Return: At the choice of the Controller, the Processor shall delete or return all the personal data to the Controller after the end of the provision of services relating to processing.

4. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

5. Term and Termination

This DPA shall remain in effect for the duration of the underlying service agreement between the parties. Upon termination of the service agreement, the Processor shall cease all processing of Personal Data and comply with the provisions set forth in Section 3 regarding the deletion or return of data.

Signature & Acknowledgment

Controller Signature: __________ Printed Name: [Name of Representative] Title: [Title of Representative] Date: [Date]

Processor Signature: __________ Printed Name: [Name of Representative] Title: [Title of Representative] Date: [Date]

Disclaimer: This document is a general framework intended for informational purposes. It does not constitute legal advice. You must consult with qualified legal counsel to ensure compliance with the specific jurisdictional requirements and the nuances of your data processing activities.