template for data processing agreement

Data Processing Agreement

Instructions for Use

• Fill in all bracketed information [__________] to accurately reflect the legal entities and specific services involved in your data processing arrangement.
• Review the technical and organizational measures in the Appendix to ensure they align with your actual security practices and industry-standard requirements (e.g., ISO 27001, SOC2).
• Once finalized, have authorized signatories from both the Controller and the Processor sign and date the document to execute the agreement.

Parties & Definitions

This Data Processing Agreement ("DPA") is entered into by and between: Controller: [Full Legal Name of Controller], with its principal place of business at [Controller Address] ("Controller"). Processor: [Full Legal Name of Processor], with its principal place of business at [Processor Address] ("Processor").

"Personal Data" means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller under the [Name of Master Services Agreement/Contract].

Operative Clauses

1. Scope and Role: The Processor shall process Personal Data only on behalf of the Controller and in accordance with the Controller’s documented instructions. The Processor acts as a data processor, and the Controller acts as a data controller.

2. Duration: The Processor shall process Personal Data for the duration of the [Name of Master Services Agreement/Contract] and until all Personal Data is deleted or returned in accordance with this DPA.

3. Nature and Purpose of Processing: The Processor shall process Personal Data for the following purpose: [Describe specific business purpose]. The categories of data subjects include: [Describe subjects, e.g., employees, customers]. The types of Personal Data include: [List data types, e.g., contact info, financial data].

4. Processor Obligations:

   • (a) The Processor shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality.
   • (b) The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption and regular testing of security effectiveness.
   • (c) The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach.

5. Sub-processing: The Processor shall not engage another processor without prior specific or general written authorization from the Controller. The Processor shall ensure that the same data protection obligations as set out in this DPA are imposed on any sub-processor.

6. Data Subject Rights: Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organizational measures for the fulfillment of the Controller’s obligation to respond to requests for exercising data subjects' rights.

7. Audit Rights: The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

8. Termination: Upon termination of the services, the Processor shall, at the choice of the Controller, delete or return all the Personal Data to the Controller and delete existing copies unless applicable law requires storage of the Personal Data.

Signature & Acknowledgment

For Controller: Signature: __________ Printed Name: __________ Title: __________ Date: [__________]

For Processor: Signature: __________ Printed Name: __________ Title: __________ Date: [__________]

Legal Disclaimer

This document is a general framework and does not constitute legal advice. Data privacy laws (such as GDPR, CCPA, or others) vary significantly by jurisdiction and industry. You must consult with qualified legal counsel to ensure this agreement satisfies all applicable regulatory requirements for your specific business operations.