A data processing agreement is required when one party processes personal data on behalf of the other. It sets out the data protection roles and obligations and is normally annexed to the main contract.
What's inside
Subject matter and durationFrames what processing the DPA covers and for how long — normally tied to the main contract.
Categories of data and data subjectsLists what kinds of personal data are processed and whose. Regulators expect this to be specific.
Processor obligationsThe processor acts only on the controller’s instructions, keeps staff confidential, and helps meet legal duties.
Sub-processorsWhether the processor can hand data to its own vendors, and on what terms.In negotiation: Ask for advance notice of new sub-processors and a right to object — silent substitution is the thing to block.
Data subject rights and breachesHelp individuals exercise their rights, and report data breaches quickly.
International transfersControls moving personal data across borders — Standard Contractual Clauses are the usual mechanism.
Return or deletionAt the end, the processor must return or delete the personal data.
How this template is reviewed
Drafted Template v1 · June 2026
Written in plain language and self-checked against comparable open standards where they exist. Independent review is pending. Every export is stamped with the template ID and version it came from. A status is never claimed until the work behind it has happened.
Committee-vetted open standards cover similar ground — compare, or use them instead: Common Paper ↗ · Bonterms ↗
How it works
1 · PickStart from this template — or add more from the library.
2 · FillEnter your details; watch the typeset preview update live.
3 · DownloadExport a polished PDF or an editable Word file.