Software and data
Data processing agreement template
Data processing agreement (DPA): A data processing agreement (DPA) is a contract required by laws such as the GDPR when one company processes personal data on behalf of another.
Upload yours for a review and e-signature, or save it as a team template.
Start freeWhen to use a data processing agreement (DPA)
- Any vendor that handles your customers’ or staff personal data
- SaaS providers serving EU, UK or other regulated customers
- Outsourced payroll, support or marketing
Data processing agreement template: clause-by-clause outline
Sample starting wording for each clause. Replace the text in [brackets] with your details.
Roles
The Customer is the controller and the Provider is the processor of the Personal Data described in Annex 1.
Instructions
The Provider will process Personal Data only on the Customer’s documented instructions.
Confidentiality and security
The Provider will ensure staff are bound by confidentiality and apply the security measures in Annex 2.
Sub-processors
The Provider may use the sub-processors listed in Annex 3 and will give [30] days’ notice of changes so the Customer can object.
International transfers
Transfers outside [the EEA/UK] will rely on an approved mechanism, such as the Standard Contractual Clauses.
Breach notification
The Provider will notify the Customer without undue delay, and within [48] hours, of a personal data breach.
Deletion and audit
At the end of the services the Provider will delete or return Personal Data and will support reasonable audits.
What to check before you sign
- Does it include every term required by the law that applies (GDPR Art. 28, UK GDPR, India’s DPDP Act, CCPA service-provider terms)?
- Are international transfers covered?
- Is the breach notification time short enough for your own deadlines?
How to send a data processing agreement (DPA) for e-signature
- Draft or upload it. Use the outline above with your own wording, upload an existing document, or save it as your organisation’s template.
- Check it against your playbook. Points outside your positions are flagged, and approval rules route it to Legal when needed.
- Send it by email. Signers get a plain-language review and a secure link, sign on any device in the order you set, and can suggest changes as tracked changes.
- Keep the signed PDF. Everyone receives it with a certificate of completion, and key dates go to Upcoming with reminders.
Data processing agreement template: frequently asked questions
Is a DPA legally required?
Under the GDPR and UK GDPR, yes, whenever a processor handles personal data for a controller. Other laws have similar requirements.
What are the Standard Contractual Clauses?
Model clauses approved by the European Commission for transferring personal data to countries without an adequacy decision.
Is an electronically signed data processing agreement (DPA) legally binding?
In most countries, yes. E-signatures are recognised for commercial contracts under laws such as the ESIGN Act (US), eIDAS (EU), the Electronic Communications Act (UK) and the Information Technology Act (India). econtracts.ai adds a certificate of completion with each signer’s identity check and a fingerprint of the signed content.
Can I get a data processing agreement (DPA) I received reviewed?
Yes. Upload it to econtracts.ai and you get a plain-language review: key dates, money and points to check, each quoting the clause it comes from.
Related contract templates
This outline is a starting point for discussion, not legal advice, and it is not a complete contract. Laws differ by country and sector; have a qualified lawyer review contracts that matter.