Data processing agreement (DPA) template

Data Processing Agreement

Parties: Controller · Processor

1. Purpose and relationship to the service contract

This agreement sets out how the Processor handles personal data on behalf of the Controller. It is added to the following contract between the parties (the service contract) and applies to the processing of personal data that the Processor carries out for the Controller in providing the services under it. Service contract: [[Name and date of the service contract]]

If this agreement and the service contract conflict as far as personal data is concerned, this agreement prevails. In all other respects the service contract applies unchanged.

2. Terms used

Personal data means information about an identified or identifiable person. Processing means any operation on personal data, such as collecting, storing, using, sending or deleting it. The Controller is the party that decides why and how the personal data is processed; the Processor is the party that processes it on the Controller’s behalf. The people concerned are the people the personal data is about.

A sub-processor is a third party that the Processor engages to carry out part of the processing. A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss or alteration of, or disclosure of or access to, the personal data. Other terms that this agreement uses and that the law applying to the Controller defines have the meaning that law gives them.

3. The processing

The Processor processes the personal data only for the following purpose and in the following way:

Subject and purpose: [[What the processing is for, e.g. hosting the Controller’s customer database]]

Nature of the processing: [[e.g. storage, backup, access for support]]

Types of personal data: [[e.g. names, email addresses, order history]]

Groups of people the data is about: [[e.g. customers, employees]]

Duration: as long as the service contract runs, and afterwards as the clause on return and deletion says.

If the data includes information that the law treats as especially sensitive, the Controller has told the Processor: [[none / the kinds of sensitive data]]

4. Instructions

The Processor processes personal data only on the documented instructions of the Controller. Documented instructions are this agreement, the service contract and the Controller’s later instructions in writing or in electronic form within the scope of the services. The Processor does not process the data for its own purposes.

The Processor tells the Controller without undue delay if it believes an instruction breaches the law that applies, and may pause carrying it out until the Controller confirms or changes it. If the law requires the Processor to process the data in another way, it tells the Controller beforehand unless the law forbids that.

5. Confidentiality of personnel

The Processor allows only people who need the personal data for the services to access it, and makes sure that they are bound by a duty of confidentiality, by contract or by law. This duty continues after their work for the Processor ends.

6. Security measures

The Processor takes appropriate technical and organisational measures to protect the personal data against accidental or unlawful destruction, loss, alteration, disclosure and access, taking into account the risks, the state of the art and the cost. The measures include at least: [[Description of the measures, e.g. access control, encryption, backups, logging, staff training, or a reference to an attached security description]]

The Processor reviews the measures regularly and may change them as long as the level of protection does not fall. It keeps the Controller’s personal data separate from other customers’ data as far as the services allow.

7. Sub-processors

The Controller gives the Processor a general authorisation to engage sub-processors. The sub-processors in use at the effective date are: [[Names, locations and tasks of the sub-processors, or none]]

The Processor tells the Controller in writing or in electronic form at least [[30]] days before it adds or replaces a sub-processor. Within that time the Controller may object on reasonable grounds related to data protection; the parties then look for a solution in good faith, and if none is found the Controller may end the affected services.

The Processor binds each sub-processor to data protection duties that protect no less than this agreement and remains responsible to the Controller for what the sub-processor does.

8. Rights of the people concerned and other help

Taking into account the nature of the processing, the Processor helps the Controller, by suitable technical and organisational measures, to answer requests from people who use the rights the law gives them over their data, such as access, correction or deletion. If the Processor receives such a request directly, it passes it to the Controller without undue delay and does not answer it itself unless the Controller instructs it to.

The Processor also gives the Controller the information and help it reasonably needs for its own duties under the law that applies, such as security, notifying breaches, assessing risks to the people concerned and consulting an authority. For help that goes beyond what is reasonable for the services, the Processor may charge at the rates of the service contract or at rates agreed in advance: [[included / charged at the rates of the service contract]]

9. Personal data breaches

The Processor tells the Controller without undue delay, and in any case within [[48]] hours, after it becomes aware of a personal data breach affecting the Controller’s personal data. The notice states, as far as known, what happened, the kinds and approximate number of people and records concerned, the likely consequences, and what the Processor has done and will do. If not everything is known yet, the Processor gives the rest in stages.

The Processor takes reasonable steps to contain the breach and limit harm, and helps the Controller with any notification the law requires. The Controller decides whether and how to notify authorities and the people concerned, unless the law requires otherwise.

10. Transfers to other countries

The Processor processes the personal data only in the following places: [[Countries or regions where the data is stored and accessed]]

It transfers the data to another country, or allows access from there, only on the Controller’s instructions or with its approval, and only where the law that applies to the Controller allows it. Where that law requires safeguards for such a transfer, the parties put them in place and record them in writing or in electronic form before the transfer takes place.

11. Audits and information

The Processor gives the Controller the information it reasonably needs to check that this agreement is kept, for example answers to written questions and relevant security reports or certificates it holds.

If that is not enough, the Controller, or an auditor it appoints who is bound to confidentiality, may carry out an audit, no more than once in [[12]] months unless a breach has occurred or the law requires more, after at least [[30]] days’ notice, during business hours and without unreasonably disturbing the Processor or putting other customers’ data at risk. Each party bears its own costs of an audit; if the audit shows a material breach by the Processor, the Processor also bears the reasonable cost of the audit.

12. Return and deletion

When the services end, or earlier on the Controller’s request in writing or in electronic form, the Processor, at the Controller’s choice, returns all personal data in a commonly used format or deletes it, within [[30]] days, and deletes existing copies, including those held by its sub-processors, unless the law that applies requires it to keep some of the data. Data that must be kept stays protected under this agreement and is used only for the purpose the law requires. On request the Processor confirms the deletion in writing or in electronic form.

13. Data protection law that applies

Data protection law differs by country. Each party complies with the data protection law that applies to it in connection with the services. The law that applies to the Controller’s processing is: [[Data protection law or laws that apply, e.g. the law of the country of the Controller]]

Each party is responsible for checking what the data protection law that applies to it requires of an agreement like this one. If that law requires terms that this agreement does not contain, or terms that differ from it, the parties add or change them in writing or in electronic form, and this agreement then applies together with them. Nothing in this agreement is meant to give less protection than that law requires.

14. Liability, term and changes

Each party’s liability under this agreement is governed by the liability clause of the service contract. This does not limit liability that the law does not allow to be limited, and it does not affect rights that the people concerned have under the law that applies.

This agreement lasts as long as the Processor processes personal data for the Controller under the service contract, and its duties continue as long as the Processor holds personal data. Changes to this agreement are valid only if both parties agree to them in writing or in electronic form.

15. Governing law and disputes

This agreement is governed by the law stated under Governing law. The parties will first try to settle any dispute in good faith. Otherwise the courts stated under Jurisdiction decide, unless mandatory law provides otherwise.

Governing law

[[Country or state whose law applies]]

Jurisdiction

[[Courts that decide disputes, e.g. the courts of your city]]