Data Processing Agreement (DPA) Template

What is a data processing agreement?

A data processing agreement is required under GDPR when one business processes personal data on behalf of another. It sets out instructions, security, sub-processors, breach notice and audit rights.

When you need one

SaaS and service providers handling client personal data
EU/UK clients asking for a DPA

Key clauses included

Processing instructions
Confidentiality of personnel
Security measures
Sub-processors
Data subject requests
Breach notification
International transfers
Deletion and audits

What the template covers

Details of Processing
Processor Obligations
Security
Sub-processors
Data Subject Rights
Assistance
Personal Data Breaches
International Transfers
Deletion or Return
Audits
Liability and Precedence
Annex 1: Description of Processing
Annex 2: Technical and Organisational Measures
Annex 3: Approved Sub-processors

How to use it

Buy and download the editable Word file.
Fill in the brackets: names, dates, fees, scope and governing law. Delete options that don't apply.
Check it against local law, and have a lawyer review it for high-value deals.
Sign it on paper or with any e-signature tool.

Frequently asked questions

What format is the template in?

You get an editable Microsoft Word (.docx) file that also opens in Google Docs, Pages and LibreOffice.

Can I use this template in my country?

The templates are written for international use with placeholders for governing law and local details. Contract law differs between countries and states, so check the final document against local law, especially for employment and consumer contracts.

Is this legal advice?

No. A template is a starting point, not advice on your situation. For high-value or unusual deals, have a lawyer review the completed document.

How do I receive the file?

Right after payment you are taken to a download page, and PayPal emails you a receipt. Keep the download page link to download the file again.

Related templates

Online Business & Tech