Data Processing Agreement (DPA)

A data processing agreement, often shortened to DPA, is a contract between two parties where one decides how personal data is used (the controller) and the other handles that data on its behalf (the processor). The typical case is a business that uses a hosting company, a payroll provider, a mailing service or a cloud software vendor to store or process the personal data of its customers or staff. Data protection laws in many countries require the arrangement to be in writing and to cover specific points, because the people whose data it is never see the processor and rely on the controller to keep control.

This template sets out those points in plain language. The processor acts only on the controller's instructions, keeps the data confidential, applies the security measures you tick in an annex, uses sub-processors only as agreed, helps with requests from the people concerned, tells the controller about a breach within the number of hours you choose, deletes or returns the data at the end, allows audits and does not move the data to other countries without approval or safeguards. You choose whether you are the controller or the processor and the clauses read the same from either side. The country versions point to GDPR Article 28 for the EU and Germany, the UK GDPR, Korea's rules on entrusted processing, Japan's duty to supervise processors and California's rules for service providers.

• You hire a hosting company, cloud tool, payroll or mailing provider that will handle your customers' or staff's personal data.
• You are a software or service provider and your customers ask for a DPA before they sign.
• You are moving data to a new provider and want the instructions, security and deletion rules in writing.
• An audit, a bank or a large customer asks for proof that your processors are under contract.

1. Say whether you are the controller or the processor, then enter both parties and the main agreement.
2. Describe the services, the purpose, whose data it is and what kinds of data are involved.
3. Tick the security measures the processor really applies, and list its sub-processors with their countries.
4. Set the hours for breach notice, the days to delete or return data, the audit notice and the rule for transfers.
5. Pick the country, read its notes, and have the finished text checked by someone who knows the law that applies.

• Ticking security measures that are not in place. The annex is a promise.
• Leaving the sub-processor list empty or out of date while the processor uses others.
• Agreeing a breach notice time that the processor cannot meet in practice.
• Treating a provider that also uses the data for its own purposes as a processor; a different arrangement may be needed.
• Signing the DPA but not updating it when the services, the data or the countries involved change.

1. Fill in
2. Check the preview
3. Save as PDF, Word or Excel

Pick the country you need. Each version uses the wording and layout commonly found there; a version marked “check with local advice” should be read by someone who knows the local rules before it is used.

• International (XX): Written in English, Korean, Japanese, German
• European Union (EU): Written in English – check with local advice
• United Kingdom (GB): Written in English – check with local advice
• United States (US): Written in English – check with local advice
• Korea (KR): Written in Korean, English – check with local advice
• Japan (JP): Written in Japanese, English – check with local advice
• Germany (DE): Written in German, English – check with local advice