# Data Processing Agreement

**Effective date:** [EFFECTIVE_DATE]

This Data Processing Agreement (the **DPA**) forms part of
[[REVIEW: IDENTIFY THE MAIN AGREEMENT, ORDER FORM, AND PRECEDENCE RULE]]
between:

- **Controller/customer:** [[REVIEW: LEGAL NAME, ADDRESS, AND CONTACT]]
- **Processor/provider:** [COMPANY_NAME], [COMPANY_ADDRESS], [CONTACT_EMAIL]

The parties' assessed processing role for the covered activity is:
**[PROCESSING_ROLE]**.

## 1. Definitions and Scope

Use the definitions in the applicable data-protection law and the main
agreement. Define any additional terms needed for clarity, including Personal
Data, Processing, Controller, Processor, Data Subject, Personal Data Breach,
Subprocessor, and applicable Data Protection Law.

The subject matter, duration, nature, purpose, data types, and data-subject
categories are described in Annex 1. Processing outside that scope requires a
lawful documented instruction or an agreed contract change.

[[REVIEW: IDENTIFY WHICH EU, EEA, UK, SWISS, US STATE, OR OTHER PROCESSOR TERMS THIS DPA IS INTENDED TO SATISFY. DO NOT LABEL THE DPA “GDPR COMPLIANT” WITHOUT A JURISDICTION-SPECIFIC REVIEW]]

## 2. Documented Instructions

The Processor will process Personal Data only on the Controller's documented
instructions, including the main agreement, product configuration, and lawful
written instructions, unless applicable law requires otherwise. Where legally
permitted, the Processor will inform the Controller before processing required
by law.

The Processor will promptly notify the Controller if, in its reasoned view, an
instruction infringes applicable Data Protection Law and may suspend the
affected processing while the parties resolve the issue.

## 3. Confidentiality and Personnel

The Processor will ensure that authorized personnel:

- access Personal Data only as needed for their duties;
- are bound by appropriate confidentiality obligations;
- receive role-appropriate privacy and security training; and
- have access removed when no longer required.

[[REVIEW: ALIGN THIS CLAUSE WITH ACTUAL HR, ACCESS, CONTRACTOR, AND OFFBOARDING CONTROLS]]

## 4. Security

Taking into account the state of the art, implementation cost, processing
context, and risk, the Processor will maintain appropriate technical and
organizational measures. The current measures are described in Annex 2.

Do not insert controls the service does not operate or evidence. Material
security commitments, notification duties, testing rights, remediation
obligations, and customer-specific requirements must be negotiated and aligned
with security documentation.

## 5. Personal Data Breaches

The Processor will notify the Controller **without undue delay** after becoming
aware of a Personal Data Breach affecting Controller Personal Data and will
provide available information reasonably necessary for the Controller's legal
assessment and notifications.

[[REVIEW: NEGOTIATE THE CONTRACTUAL NOTICE CHANNEL, INITIAL TARGET, UPDATE CADENCE, REQUIRED CONTENT, COOPERATION, FORENSICS, PRESERVATION, COSTS, AND PUBLIC-COMMUNICATION RULES. DO NOT MISSTATE THE CONTROLLER'S REGULATORY 72-HOUR DEADLINE AS A UNIVERSAL PROCESSOR-TO-CONTROLLER DEADLINE]]

The Processor will not notify regulators or affected individuals on the
Controller's behalf unless authorized or legally required.

## 6. Subprocessors

The Controller grants [[REVIEW: SPECIFIC OR GENERAL]] authorization for the
subprocessors in Annex 3, subject to the agreed notice and objection process.
The Processor will impose data-protection obligations on each Subprocessor that
provide the protection required for the covered processing and will remain
responsible as required by the applicable law and contract.

[[REVIEW: DEFINE NOTICE METHOD/PERIOD, REASONABLE OBJECTION STANDARD, REMEDIES, EMERGENCY CHANGES, AFFILIATES, AND CURRENT SUBPROCESSOR LIST URL]]

## 7. Assistance to the Controller

Taking into account the nature of processing and information available, the
Processor will provide the assistance required by applicable law for:

- data-subject requests;
- security and breach obligations;
- data-protection impact assessments and prior consultation;
- records, inquiries, and regulator cooperation.

[[REVIEW: DEFINE REQUEST CHANNELS, RESPONSE TARGETS, INCLUDED SUPPORT, EXCESSIVE REQUESTS, COSTS, AND LIMITS CONSISTENT WITH THE LAW]]

The Processor will not independently respond to a data-subject request for
Controller Personal Data unless instructed or legally required, but will route
the request appropriately.

## 8. Return and Deletion

At the Controller's choice and subject to applicable law, the Processor will
return or delete covered Personal Data after the services end. Annex 1 must
state production deletion timing, backup expiry, export format, legal holds, and
any retained data that becomes isolated from further ordinary processing.

[[REVIEW: ALIGN THIS CLAUSE WITH THE ACTUAL ACCOUNT-DELETION, BACKUP, SUBPROCESSOR, LOG, AND DISASTER-RECOVERY DESIGN]]

## 9. Demonstrating Compliance and Audits

The Processor will make information reasonably necessary to demonstrate the
covered processor obligations available through the agreed assurance process.
The parties should prioritize current independent reports, certifications,
questionnaires, and documentation before on-site inspection where legally and
commercially appropriate.

[[REVIEW: NEGOTIATE AUDIT SCOPE, FREQUENCY, NOTICE, CONFIDENTIALITY, INDEPENDENT AUDITOR, COSTS, SECURITY/OTHER-CUSTOMER PROTECTIONS, REMEDIATION, AND REGULATOR RIGHTS WITHOUT IMPERMISSIBLY LIMITING STATUTORY OBLIGATIONS]]

## 10. International Transfers

[TRANSFER_DETAILS]

Annex 4 must identify each restricted transfer, exporter/importer role, country,
legal mechanism, applicable Standard Contractual Clause module or other
instrument, supplementary measures, and required transfer assessment. Do not
state that a framework or certification applies without verifying the relevant
entity, scope, and current status.

## 11. Controller Obligations

The Controller is responsible for lawful instructions and for satisfying its own
obligations, including transparency, lawful basis, permissions, data accuracy,
minimization, user configuration, and request handling. This clause does not
reduce any independent duty of the Processor.

## 12. Liability, Priority, and Term

[[REVIEW: HAVE COUNSEL ALIGN LIABILITY, INDEMNITY, EXCLUSIONS, INSURANCE, GOVERNING LAW, DISPUTE TERMS, ORDER OF PRECEDENCE, AMENDMENT, TERMINATION, AND SURVIVAL WITH THE MAIN AGREEMENT AND NON-WAIVABLE LAW. DO NOT USE A GENERIC CAP WITHOUT COMMERCIAL AND LEGAL APPROVAL]]

## Annex 1 — Processing Details

[PROCESSING_DETAILS_TABLE]

Also specify:

- subject matter and duration;
- nature and purposes;
- data-subject categories;
- special-category/sensitive data and criminal-offense data, if any;
- frequency, scale, locations, and access model;
- Controller instructions and product configuration;
- retention, return, deletion, and backup expiry;
- high-risk or regulated processing explicitly excluded.

## Annex 2 — Technical and Organizational Measures

[TOM_SUMMARY]

Organize verified measures as appropriate across governance, risk management,
identity/access, encryption/key management, secure development, vulnerability
management, logging/monitoring, availability, backup/restore, incident response,
physical security, personnel, vendor management, deletion, tenant isolation, and
assurance. State scope and exceptions. Avoid absolute warranties.

## Annex 3 — Subprocessors

[SUBPROCESSOR_TABLE]

For each Subprocessor include legal name, service, data, role, processing
location, transfer mechanism, and notice source.

## Annex 4 — Transfer Terms

[[REVIEW: ATTACH OR INCORPORATE THE CORRECT TRANSFER INSTRUMENTS, MODULES, DOCKING/UK ADDENDUM OR IDTA TERMS, LOCAL-LAW SUPPLEMENTS, AND PARTY DETAILS AFTER COUNSEL REVIEW]]

## Signatures

**Controller**  
Name/entity: [[REVIEW: INSERT]]  
Authorized signer/title: [[REVIEW: INSERT]]  
Date: [[REVIEW: INSERT]]

**Processor — [COMPANY_NAME]**  
Authorized signer/title: [[REVIEW: INSERT]]  
Date: [[REVIEW: INSERT]]