Data Processing Agreement (DPA) Template

# Data Processing Agreement **Between**: **Data Controller**: [Your Company Name] ("Controller") **Data Processor**: [Vendor Name] ("Processor") **Effective Date**: [Date] --- ## 1. Definitions - **Personal Data**: Any information relating to an identified or identifiable natural person - **Processing**: Any operation performed on personal data - **Sub-processor**: Any third party engaged by the Processor to process personal data ## 2. Scope of Processing | Element | Details | |---------|---------| | **Subject matter** | [Description of service] | | **Duration** | Duration of the service agreement | | **Nature of processing** | [Storage, analysis, transmission] | | **Purpose** | [Provide the contracted service] | | **Categories of data subjects** | [Customers, employees, end users] | | **Types of personal data** | [Name, email, IP address, usage data] | ## 3. Processor Obligations The Processor shall: a) Process personal data only on documented instructions from the Controller b) Ensure that persons authorized to process personal data are bound by confidentiality obligations c) Implement appropriate technical and organizational security measures, including: - Encryption of personal data at rest and in transit - Access controls with multi-factor authentication - Regular security testing and vulnerability assessments - Incident response procedures - Data backup and recovery capabilities d) Not engage sub-processors without prior written consent of the Controller e) Notify the Controller of any personal data breach without undue delay (within **72 hours**) f) Assist the Controller in responding to data subject requests g) Delete or return all personal data upon termination of the agreement h) Make available all information necessary to demonstrate compliance and allow audits ## 4. Sub-Processors Current approved sub-processors: | Sub-processor | Purpose | Location | |--------------|---------|----------| | [Name] | [Purpose] | [Country] | | [Name] | [Purpose] | [Country] | The Processor shall notify the Controller at least **30 days** before adding or replacing a sub-processor. ## 5. International Transfers Personal data shall not be transferred outside of [EU/EEA] unless: - An adequacy decision exists for the destination country - Standard Contractual Clauses (SCCs) are in place - Other appropriate safeguards per GDPR Article 46 are implemented ## 6. Data Subject Rights The Processor shall assist the Controller in fulfilling data subject requests including: - Right of access - Right to rectification - Right to erasure - Right to data portability - Right to restriction of processing - Right to object Response time: within **10 business days** of receiving the request. ## 7. Security Breach Notification The Processor shall notify the Controller of any confirmed or suspected personal data breach within **72 hours**, including: - Description of the breach - Categories and approximate number of data subjects affected - Likely consequences - Measures taken to address the breach ## 8. Audit Rights The Controller may audit the Processor's compliance with this DPA: - Upon **30 days** written notice - Maximum **once per year** (unless a breach has occurred) - At the Controller's expense - Processor may satisfy audit requirements by providing current SOC 2 Type II report ## 9. Term and Termination - This DPA is effective for the duration of the underlying service agreement - Upon termination, the Processor shall delete all personal data within **30 days** and provide written confirmation - The Processor may retain data where required by applicable law, with notice to the Controller --- **Controller Signature**: ________________________ **Name & Title**: ________________________ **Date**: ________________________ **Processor Signature**: ________________________ **Name & Title**: ________________________ **Date**: ________________________