# Data Processing Agreement (DPA) Template

## Legal Basis
Art. 28 GDPR — processors must be bound by a contract covering all mandatory Art. 28(3) terms.
Failure to have a compliant DPA is itself a violation exposable to Art. 83(4) fines (up to €10M / 2% turnover).

---

## Parties

**Controller**: [CONTROLLER LEGAL NAME], [ADDRESS] ("Controller")
**Processor**: [PROCESSOR LEGAL NAME], [ADDRESS] ("Processor")

---

## 1. Subject Matter and Duration (Art. 28(3))
This DPA governs the processing of personal data by Processor on behalf of Controller in
connection with: [DESCRIPTION OF MAIN SERVICE / CONTRACT].

Duration: This DPA is co-terminus with the main service agreement dated [DATE].

## 2. Nature and Purpose of Processing (Art. 28(3))
The Processor will process personal data for the following purposes only:
- [e.g. Hosting and storing Controller's application data]
- [e.g. Sending transactional emails on Controller's instruction]

Processing shall occur only on documented instructions from the Controller (Art. 28(3)(a)).

## 3. Categories of Personal Data (Art. 28(3))
The following categories of personal data are covered by this DPA:
- [e.g. Contact data: name, email address, phone number]
- [e.g. Usage data: IP address, session identifiers]
- [List any special category data + confirm Art. 9 condition met]

## 4. Categories of Data Subjects (Art. 28(3))
- [e.g. Controller's end users / customers]
- [e.g. Controller's employees]

## 5. Processor Obligations (Art. 28(3))

### 5.1 Instructions Only (Art. 28(3)(a))
Processor shall process personal data only on documented instructions from Controller, including
with regard to transfers, unless required by law (in which case Processor shall notify Controller
unless prohibited).

### 5.2 Confidentiality (Art. 28(3)(b))
Processor shall ensure that persons authorised to process the data have committed to
confidentiality or are under a statutory obligation of confidentiality.

### 5.3 Security (Art. 28(3)(c); Art. 32)
Processor shall implement appropriate technical and organisational measures including at minimum:
- Encryption of personal data at rest and in transit
- Ongoing confidentiality, integrity, and availability of processing systems
- Ability to restore availability following incidents
- Regular testing of security measures

### 5.4 Sub-processors (Art. 28(2), 28(3)(d))
Processor shall not engage sub-processors without prior **specific or general written authorisation**
from Controller.

Current authorised sub-processors: [LIST or "See Schedule A"]

Processor shall impose equivalent data protection obligations on sub-processors (Art. 28(4)) and
remains liable to Controller for sub-processor failures.

### 5.5 Data Subject Rights (Art. 28(3)(e))
Processor shall assist Controller by appropriate technical and organisational measures to fulfil
Controller's obligation to respond to data subject rights requests (Arts. 15–22), given the nature
of processing.

### 5.6 Assistance with Controller Obligations (Art. 28(3)(f))
Processor shall assist Controller in ensuring compliance with: Art. 32 (security), Art. 33–34
(breach notification), Art. 35–36 (DPIAs), taking into account the nature of processing and
information available.

### 5.7 Deletion or Return (Art. 28(3)(g))
At Controller's choice, Processor shall delete or return all personal data upon termination of
services, and delete existing copies unless Union or Member State law requires storage.
Timeline for deletion/return: [X days after termination].

### 5.8 Audit Rights (Art. 28(3)(h))
Processor shall make available all information necessary to demonstrate compliance with Art. 28
and shall allow for and contribute to audits conducted by Controller or an authorised auditor.
Audit notice period: [X days]. Frequency: [no more than once per year absent cause].

## 6. International Transfers (Art. 44–49)
[If applicable:]
Where Processor transfers personal data outside the EEA (or UK), the following safeguard applies:
- [ ] **Adequacy decision (Art. 45):** [COUNTRY] — Key current decisions:
  - **United States:** EU–US Data Privacy Framework (DPF, July 2023) — valid but under CJEU appeal (Case C-703/25 P, registered Oct 2025); PCLOB oversight currently suspended. Maintain SCC fallback.
  - **United Kingdom:** EU adequacy decisions renewed 19 December 2025, valid through 27 December 2031.
  - [Other adequacy country — see EC adequacy list]
- [ ] **Standard Contractual Clauses (Art. 46(2)(c)):** 2021 SCCs (current version) — [MODULE: C2C / C2P / P2C / P2P — attach as Schedule B]
- [ ] **Binding Corporate Rules (Art. 47)**
- [ ] **Other (Art. 46):** [SPECIFY — e.g., derogation under Art. 49 for occasional transfers]

> ⚠️ Note for transfers to entities already subject to GDPR via Art. 3(2) extraterritorial scope: a new SCC module is in development but not yet adopted. The Dutch DPA's Uber enforcement (2024) shows that SCCs may still be required in this scenario; use existing 2021 SCCs as the safeguard until the new module is published.

## 7. Breach Notification (Art. 33)
Processor shall notify Controller of any personal data breach **without undue delay** and in any
event within **[48/72] hours** of becoming aware, providing information per Art. 33(3) to the
extent available.

## 8. Governing Law
This DPA is governed by the laws of [JURISDICTION].

---

## Schedule A — Authorised Sub-processors
| Sub-processor | Location | Processing Activity |
|--------------|----------|-------------------|
| [NAME] | [COUNTRY] | [PURPOSE] |

## Schedule B — Standard Contractual Clauses
[Attach EU Commission SCCs (2021) or UK IDTA as applicable]

---

## Drafting Checklist
- [ ] All Art. 28(3)(a)–(h) clauses present
- [ ] Sub-processor list attached or mechanism described
- [ ] Transfer mechanism documented and attached
- [ ] Breach notification timeline specified
- [ ] Deletion timeline specified
- [ ] Audit rights defined with reasonable notice period
- [ ] Signed by authorised representatives of both parties