standard data processing agreement template

Data Processing Addendum

Instructions for Use

• Fill in all bracketed fields, ensuring that the legal names of the entities match those found in your primary Service Agreement.
• Select the appropriate checkboxes in Section 4 regarding international data transfers to ensure compliance with applicable regional laws (e.g., GDPR, CCPA).
• Once completed, have an authorized signatory from both the Controller and the Processor sign and date the document to execute it as a binding addendum to your existing contract.

1. Parties and Definitions

This Data Processing Addendum ("DPA") is entered into by and between:

Controller: [Full Legal Name of Controller], with its principal place of business at [Full Address of Controller] ("Controller").

Processor: [Full Legal Name of Processor], with its principal place of business at [Full Address of Processor] ("Processor").

Definitions:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the California Consumer Privacy Act ("CCPA").
• "Services" refers to the primary agreement between the parties dated [Date of Primary Agreement].

2. Scope and Nature of Processing

The Processor shall process Personal Data only for the purpose of providing the Services as defined in the primary agreement. The duration of processing shall be for the term of the primary agreement, and the categories of data subjects and types of personal data shall be limited to those necessary to fulfill the Services.

3. Obligations of the Processor

1. Compliance: Processor shall process Personal Data in accordance with the Data Protection Laws and documented instructions from the Controller.
2. Confidentiality: Processor shall ensure that its personnel authorized to process the Personal Data have committed themselves to confidentiality.
3. Security: Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, pseudonymization, and regular testing of systems.
4. Sub-processors: Processor shall not engage another processor without prior specific or general written authorization from the Controller.
5. Data Subject Rights: Processor shall provide reasonable assistance to the Controller in responding to requests from data subjects exercising their rights under Data Protection Laws.
6. Breach Notification: Processor shall notify the Controller without undue delay after becoming aware of a personal data breach.

4. International Data Transfers

[ ] The Processor shall not transfer Personal Data outside of the jurisdiction of origin without prior written consent. [ ] The parties agree to the use of Standard Contractual Clauses (SCCs) for transfers to jurisdictions without an adequacy decision. [ ] The Processor certifies compliance with the [Insert Framework, e.g., Data Privacy Framework] for cross-border transfers.

5. Audit and Termination

Upon written request, the Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for audits conducted by the Controller or an auditor mandated by the Controller. Upon termination of the Services, the Processor shall, at the choice of the Controller, delete or return all Personal Data.

6. Signature and Acknowledgment

By signing below, the parties acknowledge and agree to the terms of this DPA.

Controller Signature: __________ Printed Name: [Name of Signatory] Title: [Title of Signatory] Date: [Date]

Processor Signature: __________ Printed Name: [Name of Signatory] Title: [Title of Signatory] Date: [Date]

Legal Disclaimer

This document is a general framework provided for informational purposes only and does not constitute legal advice. Data protection requirements vary significantly by jurisdiction and industry. You must consult with qualified legal counsel to ensure this agreement satisfies the specific compliance requirements applicable to your organization.