simple data processing agreement template

Data Processing Agreement

Instructions for Use

• Fill in all bracketed information, ensuring the legal names of the parties match those in your primary service agreement.
• Review Section 4 (Security Measures) to ensure the technical and organizational safeguards listed accurately reflect your current IT practices.
• Once completed, have an authorized representative from both the Controller and the Processor sign and date the document to execute the agreement.

1. Parties and Definitions

This Data Processing Agreement (“DPA”) is entered into as of [Date] by and between:

Controller: [Full Legal Name of Controller], with its principal place of business at [Full Business Address] (“Controller”).

Processor: [Full Legal Name of Processor], with its principal place of business at [Full Business Address] (“Processor”).

Definitions:

• “Data Protection Laws” means all applicable local, state, or federal laws, regulations, and directives relating to the processing of Personal Data.
• “Personal Data” means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller.
• “Processing” means any operation or set of operations performed on Personal Data, such as collection, storage, use, or disclosure.

2. Roles and Scope

The Processor shall process Personal Data only on behalf of the Controller and in accordance with the Controller’s documented instructions. The Processor shall not process Personal Data for its own purposes or outside the scope of the services defined in the [Name of Primary Service Agreement].

3. Obligations of the Processor

The Processor agrees to:

• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
• Ensure that persons authorized to process the Personal Data have committed themselves to confidentiality.
• Assist the Controller, by appropriate technical and organizational measures, in fulfilling the Controller’s obligation to respond to requests for exercising data subject rights.
• Notify the Controller without undue delay after becoming aware of any accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Personal Data.
• Maintain records of processing activities as required by applicable Data Protection Laws.

4. Security Measures

The Processor shall implement the following measures: [ ] Encryption of Personal Data at rest and in transit. [ ] Regular testing and evaluation of technical and organizational measures. [ ] Access controls and authentication protocols. [ ] [Other Security Measures: __________]

5. Sub-processing

The Processor shall not engage another processor (a “Sub-processor”) without prior specific or general written authorization from the Controller. The Processor shall ensure that the same data protection obligations as set out in this DPA are imposed on any Sub-processor.

6. Termination and Return of Data

Upon termination of the services, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller and delete existing copies, unless applicable law requires continued storage of the Personal Data.

7. Governing Law

This DPA shall be governed by the laws of [State/Country].

Signature & Acknowledgment

By signing below, the parties acknowledge and agree to the terms of this DPA.

Controller: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Processor: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Legal Disclaimer: This template is a general framework intended for informational purposes only. It does not constitute legal advice. You must consult with qualified legal counsel to ensure this document complies with the specific jurisdictional requirements and industry regulations applicable to your business.