Data Processing Agreement
Data Processing Agreement Generator
AI-powered · Attorney review option · All 50 states
Signature Requirements
E-Signature Valid
Data processing agreements are valid with electronic signatures under ESIGN/UETA.
Sample Data Processing Agreement Generated by Legal Tank
Data Processing Agreement
Definitions & Scope of Processing
This Data Processing Agreement ("DPA") is entered into pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any applicable national data protection laws implementing the GDPR, by and between the controller identified on the signature page ("Controller") and the processor identified on the signature page ("Processor"), collectively the "Parties." This DPA forms part of, and is incorporated by reference into, the underlying services agreement between the Parties (the "Services Agreement"). In the event of any conflict between this DPA and the Services Agreement, the terms of this DPA shall prevail with respect to data protection matters.
The following definitions apply throughout this DPA: "Personal Data" has the meaning given in Article 4(1) GDPR; "Data Subject" means the identified or identifiable natural person to whom Personal Data relates; "Processing" has the meaning given in Article 4(2) GDPR; "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data; "Supervisory Authority" means the competent data protection authority in the Controller's Member State of establishment; and "Standard Contractual Clauses" means the clauses approved by the European Commission for the transfer of Personal Data to third countries, as may be updated from time to time.
+ 1 more subsections in generated document
Processor Obligations & Security Measures
The Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk of Processing, as set forth in Annex II to this DPA, including as appropriate: (a) pseudonymization and encryption of Personal Data; (b) the ability to ensure ongoing confidentiality, integrity, availability, and resilience of Processing systems and services; (c) the ability to restore availability of and access to Personal Data in a timely manner in the event of a physical or technical incident; and (d) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational security measures.
The Processor shall ensure that any natural person acting under the Processor's authority who has access to Personal Data Processes it only on instructions from the Controller, and shall ensure that persons authorized to Process Personal Data have committed themselves to confidentiality obligations or are under an appropriate statutory obligation of confidentiality. The Processor shall not engage any sub-processor without the prior specific or general written authorization of the Controller. A list of approved sub-processors is set forth in Annex III. The Processor shall notify the Controller of any intended changes to sub-processors with sufficient advance notice to allow the Controller to object prior to the change taking effect.
+ 1 more subsections in generated document
Data Subject Rights & Breach Notification
The Processor shall, taking into account the nature of the Processing, assist the Controller by appropriate technical and organizational measures, insofar as possible, in fulfilling the Controller's obligations to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR, including the rights of access, rectification, erasure, restriction, data portability, and objection. Upon receipt of a Data Subject request addressed to the Processor, the Processor shall promptly forward such request to the Controller and shall not respond to the Data Subject directly except on documented instructions from the Controller.
In the event of a Personal Data Breach, the Processor shall notify the Controller without undue delay and, where feasible, no later than forty-eight (48) hours after becoming aware of the breach. Such notification shall include: (a) a description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned; (b) the name and contact details of the data protection officer or other contact point; (c) a description of the likely consequences of the breach; and (d) a description of the measures taken or proposed to address the breach. The Processor shall document all Personal Data Breaches, including those not reported to the Supervisory Authority.
Data Transfer & International Transfers
The Processor shall not transfer Personal Data to a country or international organization outside the European Economic Area (EEA) unless: (a) the European Commission has issued an adequacy decision for the recipient country pursuant to Article 45 GDPR; (b) appropriate safeguards are in place pursuant to Article 46 GDPR, including Standard Contractual Clauses; (c) the transfer falls within a derogation under Article 49 GDPR; or (d) the Controller has provided specific prior written authorization for the transfer. Where Standard Contractual Clauses are used for international transfers, they are incorporated by reference and form part of this DPA.
The Processor shall inform the Controller of the countries in which it and any approved sub-processors intend to Process Personal Data. The Processor shall cooperate with the Controller in conducting transfer impact assessments where required under applicable law, including assessments of the laws and practices of the recipient country that may affect the level of protection afforded to Personal Data. Where a transfer impact assessment reveals that a transfer cannot be made with equivalent protection to that afforded in the EEA, the Processor shall implement any supplementary measures identified as necessary to bring the transfer into compliance with applicable law.
View all 5 sections
Term, Audit Rights & Liability
This DPA shall commence on the effective date of the Services Agreement and shall continue in effect for so long as the Processor Processes Personal Data on behalf of the Controller. Upon termination or expiration of the Services Agreement, the Processor shall, at the Controller's election, delete or return all Personal Data and existing copies thereof, unless applicable law requires storage of the Personal Data. The Processor shall certify its compliance with this deletion or return obligation in writing to the Controller within thirty (30) days following the termination of Processing activities.
The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or by an independent auditor mandated by the Controller. The Controller shall provide the Processor with at least thirty (30) days' advance written notice of any audit and shall conduct audits no more than once per calendar year unless a Personal Data Breach or regulatory investigation justifies more frequent review. Each Party's aggregate liability under this DPA shall be subject to the limitations and exclusions set forth in the Services Agreement, except with respect to obligations under applicable mandatory data protection law.
What Is a Data Processing Agreement?
A data processing agreement (DPA) is a legally binding contract between a data controller (the organization that determines the purposes and means of processing personal data) and a data processor (the organization that processes data on the controller's behalf). Required by Article 28 of the General Data Protection Regulation (GDPR), the DPA establishes the scope, nature, and purpose of data processing, the obligations of both parties, and the technical and organizational measures to protect personal data.
DPAs are mandatory whenever a business shares personal data with a service provider that processes it on their behalf, cloud hosting providers, email marketing platforms, payment processors, analytics services, CRM systems, and any third-party vendor that handles personal data. The GDPR imposes direct obligations on data processors (not just controllers), and both parties can face significant fines for non-compliance. GDPR fines can reach €20 million or 4% of global annual turnover, whichever is higher.
Beyond the GDPR, DPAs are increasingly required by other privacy frameworks. The CCPA requires service provider agreements with specific contractual provisions. Brazil's LGPD, Canada's PIPEDA, and other national privacy laws impose similar requirements. Even in jurisdictions without specific DPA requirements, having a well-drafted agreement that governs data processing relationships is a best practice that reduces risk and demonstrates accountability.
Legal Tank provides data processing agreement templates that satisfy GDPR Article 28 requirements and can be adapted for other privacy frameworks, helping businesses maintain compliance across their vendor relationships.
Why You Need a Data Processing Agreement
GDPR Article 28 makes DPAs legally mandatory, processing personal data through a third party without a DPA is a direct violation
Data protection authorities audit DPAs during investigations and can fine both controllers and processors for inadequate agreements
A well-drafted DPA allocates risk between the parties and establishes clear procedures for handling data breaches, audit requests, and data subject rights
Due diligence on vendor data protection practices, documented through DPAs, is a key element of GDPR accountability and demonstrating compliance
Key Sections in a Data Processing Agreement
Subject Matter and Duration
Define the nature and purpose of the data processing, the types of personal data processed, the categories of data subjects, and the duration of processing. These details are mandatory under GDPR Article 28(3) and scope the processor's authorized activities.
Processor Obligations
Establish the processor's duties: process data only on documented instructions from the controller, ensure confidentiality, implement appropriate security measures, assist with data subject rights requests, support compliance audits, and delete or return data upon termination.
Security Measures
Specify the technical and organizational security measures the processor must implement, encryption, access controls, incident response procedures, business continuity, regular security testing, and employee training. These should be proportionate to the risk level of the data processed.
Sub-Processor Management
Address the processor's use of sub-processors, whether prior specific or general authorization is required, the notification procedure for new sub-processors, and the requirement that sub-processors be bound by the same data protection obligations.
Data Breach Notification
Define the processor's obligations in the event of a personal data breach, notification timeline (GDPR requires "without undue delay"), content of the notification, cooperation with the controller's breach response, and documentation requirements.
International Data Transfers
Address transfers of personal data outside the EEA, the legal mechanisms for transfer (Standard Contractual Clauses, adequacy decisions, Binding Corporate Rules), and the supplementary measures required following the Schrems II decision.
Data Processing Agreement Legal Requirements
GDPR Article 28(3) mandates specific provisions in every DPA: documented instructions, confidentiality, security measures, sub-processor rules, data subject rights assistance, breach notification, audit rights, and data deletion/return
Standard Contractual Clauses (SCCs) are required for transfers of personal data from the EEA to countries without adequate data protection, following the European Commission's 2021 updated SCCs
The CCPA requires service provider agreements that prohibit the service provider from selling personal information and limit the use of data to the business purposes specified in the agreement
Data processors have direct obligations under the GDPR and can be fined independently for violations, processors are not merely pass-through entities
Records of processing activities (ROPA) must include details of data processing agreements as part of GDPR Article 30 documentation requirements
Common Data Processing Agreement Mistakes to Avoid
Using personal data from a processor without a DPA in place, which is itself a GDPR violation regardless of whether a breach occurs
Copying a generic DPA template without customizing it for the specific processing activities, data types, and security requirements
Failing to address sub-processor management, which is a mandatory GDPR Article 28 requirement and a common audit finding
Not including data breach notification timelines that are specific enough to enable the controller to meet its own 72-hour notification obligation
Omitting provisions for data return or deletion upon termination, leaving personal data with a former processor indefinitely
Not requiring the processor to assist with Data Protection Impact Assessments (DPIAs) when the processing is likely to result in high risk
Frequently Asked Questions About Data Processing Agreements
What is a data processing agreement (DPA)?
When do I need a data processing agreement?
What must a GDPR data processing agreement include?
What is the difference between a data controller and data processor?
Does a DPA need to be signed?
What happens if a data processor violates the DPA?
More Legal Document Generators
Get a Professionally Drafted Data Processing Agreement
On a budget? Download the free template or use the AI generator above for a quick, affordable option.
Want a professionally drafted document instead?