Data Processing Agreement Template
What data a supplier handles for you, on what terms, and what happens at the end.
Details
data processing agreement templateUploads
Your logo
A photo or picture
Goes on this page only. Drag it anywhere and pull its corner to resize it.
Your signature
Draw it with a finger, a mouse or a trackpad, and it goes on the page like a picture.
Pictures and signatures stay on this device. Nothing is uploaded to a server.
Red highlights mark what is still blank. Click anything on the page to change it. Your draft is kept on this device as you work.
Written to be usable as it stands. If the amount at stake is large or the other side has lawyers, a reviewed and jurisdiction-specific version is worth the fee.
This agreement is made on October 14, 2026 between [customer] of [address] (“the Controller”) and [supplier] of [address] (“the Processor”). It supplements the services agreement between them and governs personal data processed under it.
1. What is processed
| Purpose | [what the processing is for] |
| Whose data | [categories of people] |
| Duration | [how long] |
2. Categories of data
[add one category per line]
3. Instructions
The Processor will process the data only on the Controller’s documented instructions, including for transfers, and only for the purpose above. It will tell the Controller if it believes an instruction breaches applicable data protection law, and may pause that instruction until the point is resolved.
4. Confidentiality and people
The Processor will ensure everyone it authorises to process the data is under a duty of confidentiality, has been trained appropriately, and has access only to what their role requires.
5. Security
The Processor will keep appropriate technical and organisational measures in place against unauthorised access, loss, alteration and disclosure — including access control, encryption of data in transit and at rest, logging, backup, and tested restoration — proportionate to the risk and the nature of the data.
6. Sub-processors
The Processor will not engage a sub-processor without the Controller’s prior written authorisation. Where one is authorised, it is bound to terms no less protective than these, and the Processor remains fully liable for what it does.
7. Where the data is processed
[locations, and the basis for any transfer]
8. Requests from individuals
The Processor will not respond to a request from an individual about their data unless the Controller tells it to. It will pass any such request on within three working days and will help the Controller answer it, including with access, correction, deletion and portability.
9. Breaches
The Processor will tell the Controller without undue delay, and in any event within 24 hours, of becoming aware of any breach of security affecting the data, with what it knows at the time, and will keep the Controller updated as it learns more. It will not notify a regulator or an individual about a breach involving the Controller’s data unless the law requires it to or the Controller asks.
10. Audit
The Processor will make available the information needed to show it is meeting this agreement, and will allow an audit by the Controller or its appointed auditor on 30 days’ notice, no more than once a year unless a breach or a regulator requires otherwise.
11. Return or deletion
On the end of the services, and at the Controller’s choice, the Processor will return the data or delete it, and will delete existing copies, unless the law requires it to keep them — in which case it will say what it is keeping, why, and for how long. Backups are deleted at the next scheduled cycle.
12. Governing law
This agreement is governed by the laws of [jurisdiction].
What is a Data Processing Agreement?
A data processing agreement records what personal data a supplier handles on your behalf, what they may do with it, how they protect it and what happens to it when the contract ends. It exists because the organisation that decides why data is collected stays answerable for it even after handing it to someone else. Without a written agreement, a supplier's breach becomes your regulatory problem with nothing on paper showing what you required.
The controller — the organisation that decides why and how personal data is used — puts a DPA in place with every processor acting on its instructions: a payroll bureau, a cloud host, an email platform, an outsourced support desk, a marketing agency. It is usually signed as an annex to a services contract rather than as a standalone document, and procurement teams increasingly ask for it before onboarding. Processors sign equivalent terms with their own sub-processors, which is how a chain of accountability reaches the data centre at the far end.
The required content is set by the law that applies to the data, not by the supplier's home country. Article 28 of the EU GDPR and the UK GDPR list the terms a processor contract must contain; India's Digital Personal Data Protection Act places obligations on data fiduciaries dealing with processors; California's privacy legislation requires specific service provider terms; Canada and Australia have their own accountability rules for onward transfers. International transfers add another layer — standard contractual clauses, an adequacy finding or another approved mechanism. Check what the applicable regime requires before adapting anything.
A DPA does not make processing lawful. You still need a lawful basis, a privacy notice and, where required, a transfer mechanism and an impact assessment — the agreement only governs the relationship with the supplier. It does not shift liability away from you in a regulator's eyes, and it is not a security certification: a clause promising appropriate technical and organisational measures proves nothing until someone checks what the supplier actually runs. It also cannot turn a processor into a controller or the reverse, since the roles follow who decides the purpose.
What to put in a Data Processing Agreement
These are the details this template asks for. Anything left blank is marked in red on the preview so you can see what is still missing.
| Field | What goes in it |
|---|---|
| First party | For example: Barton Supply Co. |
| First party address | For example: Unit 7, Barton Road, Columbus, OH 43212 |
| Second party | For example: Halliwell Interiors Inc. |
| Second party address | For example: 44 High Street, Columbus, OH 43215 |
| What the processing is for | For example: Running the payroll for the customer’s employees |
| Whose data | For example: The customer’s current and former employees |
| Data covered | One per line |
| For how long | For example: For the term of the services agreement, plus 90 days for return or deletion |
| Where the data is processed | For example: the United States only. No transfer outside the United States without the customer’s… |
| Sub-processors permitted optional | One per line |
| Governing law | For example: England and Wales |
How to write a Data Processing Agreement
Describe the processing in specific terms
Set out, in an annex, the subject matter, duration, nature and purpose of the processing, the categories of individuals and the categories of personal data. ‘Customer support records: name, email address, order history and ticket correspondence for UK and EU customers, retained for the contract term’ is usable. ‘Personal data as required for the services’ tells an auditor nothing and is the clause regulators pick on first.
Bind the processor to your instructions
State that the processor acts only on documented instructions from you, including for transfers outside the region, and that it flags any instruction it believes to be unlawful. Say what happens if it processes for its own purposes — typically it becomes a controller for that activity and loses the protection of this agreement. Record where instructions may validly be given, such as a named contact or a ticketing channel.
Set security, confidentiality and breach timing
Require confidentiality undertakings from everyone with access, and describe security measures at a level you could actually verify: encryption in transit and at rest, access control and periodic review, logging, backup and restore testing. Then fix the breach notification clock — how many hours the processor has after becoming aware, what the notice must contain, and who they reach out of hours.
Control sub-processors and audit rights
Choose between specific prior approval and general authorisation with advance notice of changes and a right to object, then state the notice period in days. Require the processor to impose equivalent terms downstream and to stay liable for its sub-processors. Give yourself information and audit rights, and say what satisfies them in practice — a recognised third-party report, a completed questionnaire, or an on-site inspection on notice.
Say what happens at the end
State whether data is returned or deleted at termination, in what format, within how many days, and how deletion is confirmed. Carve out copies the processor must retain to meet its own legal obligations and say how long those are held. Add assistance obligations that survive the contract: help with individual rights requests, breach investigations and regulator queries that arrive after the services stop.
Common mistakes
- Describing the data as ‘all personal data provided by the client’ leaves nobody able to say whether a new feature that starts collecting location data is inside the agreement or outside it.
- Accepting general authorisation for sub-processors with no notice period means a critical part of your processing can move to a new country before you hear about it.
- Setting breach notification as ‘without undue delay’ with no hours attached leaves you unable to meet your own regulator deadline, because the clock started with the processor and not with you.
- Signing a DPA and never checking the security measures behind it produces a document that reads well and describes a system nobody has verified.
- Omitting the return-or-delete clause means data sits on a former supplier's systems indefinitely, still your responsibility and no longer under your control.
Frequently asked questions
Who needs to sign a data processing agreement?
Any organisation that hands personal data to a supplier processing it on its behalf, and the supplier receiving it. The trigger is the relationship, not the size of either party — a two-person agency using a mailing platform is in the same position as a bank using a cloud host. Where the supplier decides its own purposes for the data it is a controller, and you need different terms rather than a DPA.
What is the difference between a controller and a processor?
The controller decides why personal data is processed and broadly how. The processor acts on the controller's instructions and has no independent purpose of its own. The labels matter because the obligations differ, and they are decided by what actually happens rather than by what the contract calls each party. A supplier that starts using your data to improve its own product has stepped outside the processor role.
Is a DPA the same as a privacy policy?
No. A privacy policy is addressed to individuals and explains what you do with their data. A DPA is a contract between two organisations governing how a supplier handles data for you. Both may be legally required and neither substitutes for the other. Publishing a polished privacy policy while running an unwritten supplier relationship leaves the accountability gap exactly where a regulator will look.
Do I need a DPA for a supplier outside the EU or UK?
Usually yes if the data is covered by EU or UK rules, and the agreement will normally need a transfer mechanism as well — standard contractual clauses, an adequacy finding, or another approved route with a transfer risk assessment. The requirement follows the data, not the supplier's address. Confirm the current mechanism with a data protection adviser, since approved routes are revised periodically.
Can I just use the supplier's standard DPA?
Often, and most large platforms will only offer their own. Read the sub-processor list, the breach notification window, the audit provision and the deletion terms before accepting, and check that the processing description actually covers what you will send them. If a clause conflicts with a commitment in your own privacy notice, that conflict is yours to resolve rather than theirs.
This page explains general practice and is not legal advice. Requirements differ between countries and, in some cases, between states — check what applies where the document will be used.