what is a data processing agreement

Data Processing Addendum

Instructions for Use

• Review the definitions section carefully to ensure the roles of Controller and Processor are correctly assigned based on your specific service relationship.
• Fill in all bracketed fields with the formal legal names, addresses, and jurisdictional details relevant to both entities.
• Ensure this document is signed by an authorized signatory for both parties and attached as an addendum to your primary Master Services Agreement or Software License Agreement.

Parties and Definitions

This Data Processing Addendum ("DPA") is entered into by and between:

Controller: [Full Legal Name of Controller], a [State/Country] corporation with its principal place of business at [Street Address, City, State, Zip] ("Controller").

Processor: [Full Legal Name of Processor], a [State/Country] corporation with its principal place of business at [Street Address, City, State, Zip] ("Processor").

Definitions:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Applicable Data Protection Laws" means all laws and regulations, including but not limited to GDPR, CCPA/CPRA, or other regional privacy statutes, applicable to the processing of Personal Data under this agreement.
• "Security Incident" means any unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

Operative Terms

1. Scope of Processing: Processor shall process Personal Data only on behalf of the Controller and in accordance with the documented instructions of the Controller. The nature and purpose of the processing are as follows: [Describe specific services and data types].

2. Compliance with Laws: Each party shall comply with its respective obligations under all Applicable Data Protection Laws. Processor shall notify Controller immediately if, in its opinion, an instruction infringes upon applicable privacy regulations.

3. Confidentiality: Processor shall ensure that its employees, agents, and sub-processors authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. Technical and Organizational Measures: Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, pseudonymization, and the ability to ensure the ongoing confidentiality, integrity, and availability of processing systems.

5. Sub-processing: Processor shall not engage any third-party sub-processor without the prior written authorization of the Controller. Processor remains fully liable for the acts and omissions of its sub-processors.

6. Data Subject Rights: Taking into account the nature of the processing, Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller’s obligation to respond to requests for exercising Data Subject rights.

7. Security Incident Notification: Processor shall notify Controller without undue delay after becoming aware of a Security Incident. Such notification shall include sufficient information to allow the Controller to meet any obligations to report or inform Data Subjects of the incident.

8. Deletion or Return of Data: Upon termination of services, Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller, unless applicable law requires continued storage.

Signature and Acknowledgment

For Controller: Signature: __________ Printed Name: [] Title: [] Date: [__________]

For Processor: Signature: __________ Printed Name: [] Title: [] Date: [__________]

Legal Disclaimer: This document is a general framework provided for informational purposes only and does not constitute legal advice. Data privacy regulations vary significantly by jurisdiction. You must consult with qualified legal counsel to ensure this template meets the specific compliance requirements of your industry and geographic region.