Data Processing Agreement Template: Clauses, Annexes and Free PDF

The contract is signed, the pilot starts Monday, and then procurement sends one line: "Please countersign the attached DPA before we load any data." You do not have a data processing agreement template of your own. You are not sure whether to sign theirs, send yours, or write something from scratch tonight.

A data processing agreement (DPA) is the contract that GDPR Article 28 requires between a controller and a processor. It fixes what the processor may do with personal data, which security and sub-processor rules apply, and what happens on a breach, an audit and at the end of the service. A template only works once its annexes describe your real processing.

By the end of this guide you will know which clauses are fixed and which are open, how to fill the three annexes for a SaaS product, what to offer a customer who sends their own paper, and how to keep the signed agreements accurate. You also get a free, ungated PDF with sample wording for every clause.

Here's what I'll cover:

• What a data processing agreement is, and which other documents it is not
• The controller or processor test that decides which version you need
• Every Article 28 requirement, clause by clause, with sample wording
• The three annexes, filled in for a SaaS product
• How to negotiate with an enterprise customer
• How to sign, store and update your DPAs

This guide is practical information, not legal advice. Have counsel review the final agreement before it goes to a customer.

What Is a Data Processing Agreement Template, and Which Contract Does It Replace?

A data processing agreement template, often shortened to DPA template, is a fill-in version of the written contract between a company that decides why personal data is processed (the controller) and a company that processes it on the controller's behalf (the processor). It does not replace your master services agreement. It sits next to it, or inside it, and governs only the personal data.

Who needs one is simple to state. Any controller that hands personal data to a processor needs one, and any processor that engages another processor (a sub-processor) needs one with that company too. A SaaS company is usually on both sides: it signs a DPA with each customer, and it signs a DPA with the cloud host, the email provider and every other vendor that touches customer data.

Data Processing Addendum Template vs Stand-Alone Agreement: Same Content, Different Wrapper

You will see both words. A data processing addendum template is the same Article 28 content attached to a master services agreement. A stand-alone data processing agreement is a separate document. The clauses are identical. What changes is the wrapper and the order of precedence, meaning which document wins when the two conflict.

Data Processing Agreement Template vs Privacy Policy, Terms of Service and Vendor Policy: Which Document Does What

This page covers the external contract with a counterparty. It is not your public privacy policy, not your customer terms of service, and not the internal policy that tells staff how to onboard vendors. Mixing them up is the most common reason a customer rejects a DPA.

Document	Who reads it	What it binds	Who signs	What a reviewer asks
Data processing agreement	The customer's legal and security team	How you handle their personal data as processor	Both companies	"Does it cover every Article 28 item and match what you actually do?"
Privacy policy	Website visitors, users	How you handle your own visitors' and account holders' data as controller	Nobody, it is published	"Is it current and consistent with the DPA and your sub-processor list?"
Terms of service	Customers	Commercial terms of the service	Accepted or signed	"Where is liability capped, and does the DPA override it?"
Vendor management policy	Your own staff	How you select, review and offboard vendors	Internal approval	"Who approves a new vendor, and where is the DPA step?"

For the internal side, ComplyJet's vendor management policy template covers how staff run vendor onboarding. The DPA is one of the documents that policy tells them to collect.

Data Processing Agreement vs Standard Contractual Clauses: Two Different Jobs

A DPA governs how a processor handles data for a controller, so a data processing agreement vs standard contractual clauses comparison is really a comparison of two jobs. Standard contractual clauses (SCCs) for transfers are a different instrument for moving personal data to a country outside the EU or UK. The two often sit in the same signed package, but they answer different questions.

The Commission's own guidance explains the overlap.

The requirements of Article 28 are built into Module Two (controller to processor) and Module Three (processor to processor) of the transfer SCCs, so parties using those modules do not need a separate Article 28 contract for that transfer, per the Commission's SCC questions and answers.

Most SaaS companies still sign a full DPA, because the transfer SCCs only apply to restricted transfers and your customers expect one document covering everything. Transfer mechanics themselves, including modules, adequacy and assessments, are covered in ComplyJet's guide to cross-border data transfer requirements. This page only tells you where the DPA points to them.

Controller or Processor? The Role Test Before You Pick a Data Processing Agreement Template

The test is one question: who decides why and how the data is processed? The controller decides. The processor acts on the controller's documented instructions. The controller processor agreement template you choose depends on this answer, because the clauses protect whichever party you are.

For a typical SaaS company the answer changes by data type:

Data	Your role	Which contract covers it
Content customers upload or generate in your product	Processor	Customer-facing DPA
Your own website visitors, trial users and billing contacts	Controller	Your privacy policy
Your hosting, email, support and analytics vendors, when they handle customer data	You are processor, they are sub-processors	Vendor-facing DPA
Your marketing and sales tools, handling your own prospects	You are controller, they are processors	Vendor-facing DPA
LLM or AI API providers that receive customer content	Sub-processors	Vendor-facing DPA

That gives you two directions. A customer-facing DPA has your company as processor and the customer as controller. A vendor-facing DPA has your company as controller, or as a processor engaging a sub-processor. The free PDF below contains the customer-facing agreement and a one-page checklist for the vendor side.

If the data is protected health information, a business associate agreement is the required contract instead. ComplyJet's HIPAA business associate agreement guide covers what that one has to contain.

Why Enterprise Customers Ask for a Data Processing Agreement Template Before They Load Data

Article 28(3) says processing by a processor "shall be governed by a contract." Article 28(9) says that contract must be in writing, and electronic form counts. Both sides carry exposure for getting it wrong: the obligations of controllers and processors in Articles 25 to 39, which include Article 28, sit in the tier of fines of up to EUR 10 million or 2 percent of worldwide annual turnover, whichever is higher, under Article 83(4)(a).

That is why the customer asks first. They are the controller. If a processor with no compliant contract mishandles their data, the customer's regulator will ask them why they let it happen.

The commercial effect is faster than the legal one. The security review stops, procurement waits, and a pilot that was supposed to start Monday starts in three weeks.

A question on Hacker News in a June 2025 Launch HN thread shows how this looks from the buyer's side: one commenter asked why a data processing agreement was offered "only" on the enterprise plan.

A reply in the same thread, speaking for the company, said it had a default DPA it was "willing to sign on all tiers", and that the pricing page meant custom or redlined DPAs, which become complex to manage. A standard DPA ready to send is a sales asset, not paperwork.

For the wider set of obligations behind this contract, ComplyJet's GDPR compliance requirements guide walks through them.

GDPR Data Processing Agreement Template Requirements: What Article 28 Says, Clause by Clause

What should a data processing agreement include? Article 28(3) requires the contract to set out the subject matter, duration, nature and purpose of the processing, the types of personal data, the categories of data subjects, and the controller's obligations and rights, and to bind the processor to eight specific duties. The wording below follows the text of Article 28.

Article 28 item	What the contract must say	Where it lives in the document	What a reviewer checks
28(3) opening details	Subject matter, duration, nature and purpose, data types, data subject categories	Clause 1 and Annex I	Does Annex I describe your product, not a generic example?
(a) Documented instructions	Process only on documented instructions, including for transfers; flag a conflicting legal duty first	Clause 2	Where are the instructions, and who can change them?
(b) Confidentiality	Persons authorized to process are bound by confidentiality	Clause 3	Is it staff, contractors and agency workers?
(c) Security	All measures required under Article 32	Clause 3 and Annex II	Does Annex II match what you actually run?
(d) Sub-processors	Conditions of Article 28(2) and (4)	Clause 4 and Annex III	Is there a list, a notice rule and a right to object?
(e) Data subject requests	Help the controller respond, given the nature of processing	Clause 5	Do you forward requests and not answer them yourself?
(f) Articles 32 to 36	Help with security, breach notification, impact assessments, prior consultation	Clauses 5 and 6	Is there a named contact and a content list for breach notices?
(g) Deletion or return	At the controller's choice, delete or return, and delete copies unless law requires storage	Clause 8	Who chooses, and how fast?
(h) Information and audits	Provide information to show compliance; allow and contribute to audits and inspections	Clause 7	What replaces an on-site audit?
Final subparagraph	Tell the controller immediately if an instruction infringes data protection law	Clause 2	What happens next?

An Article 28 GDPR data processing agreement that only pastes the Article into a document does not meet the standard European regulators expect. The European Data Protection Board (EDPB) says in its Guidelines 07/2020 on controllers and processors that the processing agreement should not merely restate the provisions of the GDPR, and should instead give specific, concrete information on how the requirements will be met and which level of security is required. The annexes are where that detail goes.

Article 28 GDPR Data Processing Agreement Changes for UK GDPR and CCPA

UK GDPR. The ICO lists the same eight minimum terms for a UK controller and processor contract, and says an instruction can be documented in any written form, including email, as long as it is saved so there is a record. See the ICO's page on what needs to be included in the contract.

CCPA and CPRA. California does not use the word processor. It uses "service provider" and "contractor", and the regulations list their own mandatory contract terms in 11 CCR 7051. The list includes:

• A ban on selling or sharing the personal information
• Specific business purposes, not generic ones
• No retaining, using or disclosing it outside those purposes or outside the direct business relationship
• A duty to comply with the CCPA at the same level of privacy protection
• The business's right to take reasonable steps to check compliance, which may include reviews, scans and assessments, and to stop and remediate unauthorized use
• A duty to notify the business if the provider can no longer meet its obligations
• Help with consumer requests, and a compliant contract with any subcontractor

A DPA that carries these as a short regional paragraph usually covers both regimes in one document. ComplyJet's CCPA compliance guide covers the rest of California's rules.

Data Processing Agreement Template Clauses: What to Write, With Sample Wording

This is the example a customer's reviewer will compare you against: a data processing agreement example with real sample wording, not placeholders. Each clause below follows the same four beats: what the law requires, a sample clause, the commercial choice you are making, and a one-line verdict. Brackets mark values you set. The PDF carries the same wording in full.

Data Processing Agreement Template Clause 1: Subject Matter, Duration and Description of Processing

What the law requires: Article 28(3) wants the subject matter, duration, nature and purpose, data types and data subject categories in the contract.

The choice: none. The details belong in Annex I, not in the clause.

Verdict: a generic description is the easiest failure to avoid and the one a reviewer sees first.

Data Processing Agreement Template Clause 2: Documented Instructions and the Infringing-Instruction Notice

What the law requires: processing only on documented instructions, including for transfers to third countries, unless law requires otherwise, in which case the processor tells the controller first unless that law forbids it. The processor must also tell the controller immediately if, in its opinion, an instruction infringes data protection law.

The ICO accepts any written form, so the agreement plus the customer's configuration of the service can count as the instructions. EDPB Guidelines 07/2020 (paragraph 149) recommend agreeing in the contract what happens after an infringing-instruction notice, for example that the processor may suspend the instruction until the controller confirms, amends or withdraws it, or that either party may terminate if the controller persists.

The choice: whether product improvement, analytics or model training on customer content is allowed at all. If it is, say so in the clause and in Annex I. If it is not, say that too.

Verdict: the no-secondary-use sentence is the one customers read twice.

Data Processing Agreement Template Clause 3: Confidentiality and Security Measures

What the law requires: persons authorized to process are bound by confidentiality or a statutory duty of confidentiality, and the processor takes all measures required under Article 32.

The choice: how much of your SOC 2 or ISO 27001 report you reference. A report can be evidence of the measures, but it does not replace Annex II.

Verdict: write the annex from controls you actually run.

Data Processing Agreement Template Clause 4: Sub-Processors, Notice, Objection and Flow-Down

What the law requires: the processor cannot engage another processor without the controller's prior written authorization, specific or general. Under a general authorization, the processor must inform the controller of intended additions or replacements so the controller can object. The same data protection obligations must be imposed on the sub-processor by contract, and the first processor stays fully liable to the controller for the sub-processor's performance (Article 28(2) and (4)).

The Commission's own controller-to-processor clauses (Implementing Decision (EU) 2021/915) set out the same two routes, and the decision is available on EUR-Lex.

Under the first, the processor needs the controller's prior specific written authorization and sends its request a set time ahead.

Under the second, the controller gives general authorization for sub-processors on an agreed list, and the processor informs the controller in writing of additions or replacements a set time ahead so the controller can object. Clause 7.7 of the decision leaves the time period for the parties to fill in. General authorization with notice and a right to object is the common SaaS choice, because it lets you change vendors without a signature each time.

On identity, the EDPB's Opinion 22/2024, adopted on 9 October 2024, concludes that controllers should have the identity of all processors and sub-processors, meaning name, address and contact person, readily available at all times, and that the processor should proactively provide that information and keep it up to date. That is the reason Annex III exists and the reason data processing agreement sub-processors should be listed there and match a maintained sub-processor page.

The choice: the notice period, the objection window and what happens if the objection cannot be resolved (usually a right to terminate the affected service). Article 28 sets none of these.

One caution on form. EDPB Guidelines 07/2020 (paragraph 110) say any change a processor proposes to a standard DPA must be notified to and approved by the controller, and that simply publishing the change on a website is not compliant. That applies to the DPA text. Changes to the sub-processor list are different, because the contract itself authorizes them on notice.

Verdict: a list that is not kept current is worse than no list.

For due diligence on the sub-processors themselves, see ComplyJet's third-party risk management policy guide.

Data Processing Agreement Template Clause 5: Data Subject Requests and Assistance

What the law requires: the processor helps the controller respond to data subject requests, and helps with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36, taking into account the nature of the processing.

The choice: whether reasonable assistance is free or charged beyond a threshold. Say so in the clause.

Verdict: forward, do not answer.

Data Processing Agreement Template Clause 6: Breach Notification, Who Owes What and by When

Data processing agreement breach notification terms start by fixing a common confusion. Two different clocks exist under Article 33, and they belong to different parties.

Party	Duty	Source	Clock
Controller	Notify the supervisory authority of a breach	Article 33(1)	Without undue delay and, where feasible, not later than 72 hours after becoming aware
Processor	Notify the controller of a breach	Article 33(2)	Without undue delay after becoming aware
Both, by contract	Agree a number of hours for the processor's notice, a contact point and the minimum content	EDPB Guidelines 07/2020	A commercial choice, not set by the Article

The 72 hours is the controller's deadline to the authority, not the processor's deadline to the controller.

EDPB Guidelines 07/2020 say it may be appropriate to put a specific timeframe, such as a number of hours, in the contract, and that legal responsibility for notifying the authority stays with the controller even if the processor is authorized to notify directly. Because the controller's own clock starts when it becomes aware, a processor notice that takes two days eats most of the controller's window. That is the reason customers push for a short fixed figure.

The choice: the number of hours and who is the contact. Article 33(2) sets neither.

Verdict: write the window you can actually meet at 3 a.m. on a Sunday, not the one you would like to promise.

For the controller-side process behind this clause, see ComplyJet's GDPR breach notification guide.

Data Processing Agreement Template Clause 7: Audit Rights and Compliance Evidence

What the law requires: the processor provides all information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, by the controller or another auditor the controller mandates.

The practical structure is a ladder.

The first rung is information you already produce: a current SOC 2 or ISO 27001 report and a completed security questionnaire. The second is a remote review of documents and a call.

The third is an on-site or technical audit, on reasonable notice, at a reasonable frequency, or where a regulator requires it or there are signs of non-compliance.

Where the customer is a California business, the regulations also give it the right to take reasonable steps to check compliance. The Commission's own clauses under Implementing Decision (EU) 2021/915 follow the same shape: audits at reasonable intervals or where there are signs of non-compliance, with notice, by the controller or an independent auditor it appoints.

The choice: frequency, notice, who pays, and whether the report satisfies the right in the first instance.

Verdict: offer the report first, the audit second.

Data Processing Agreement Template Clause 8: Deletion or Return at the End of the Contract

What the law requires: at the controller's choice, delete or return all personal data after the services end, and delete existing copies unless EU or Member State law requires storage.

The choice: the export format, the windows, and how backups are handled. Backups are where most deletion promises fail, so state the cycle.

Verdict: deletion is a date, not a promise.

For the retention rules that sit behind this clause, see ComplyJet's data retention policy guide.

Data Processing Agreement Template Clause 9: International Transfers and the Annex Pointer

The DPA does not itself move data across borders. It names the mechanism that does, and says which instrument prevails if the two conflict.

Which mechanism, which module, and what assessment sits behind it is covered in cross-border data transfer requirements.

Data Processing Agreement Template Clause 10: Liability, Governing Law and Order of Precedence

None of this is set by Article 28. Liability between the parties, governing law and the order of precedence are commercial terms, and they are where counsel earns the fee.

Two statutory rules sit underneath them. Under Article 82, a processor is liable for damage caused by processing only where it has not complied with obligations directed specifically at processors, or where it acted outside or contrary to the controller's lawful instructions.

And where several controllers or processors are involved in the same processing and are responsible for the damage, each can be held liable for the entire damage towards the data subject. What the contract can do is allocate cost between the two companies afterwards.

Keep the order of precedence short: transfer mechanism first, then the DPA on data protection matters, then the master agreement.

What Should a Data Processing Agreement Include in Its Annexes? Processing Details, Security Measures and Sub-Processors

The annexes are where a template becomes your agreement. Three of them carry the content that Article 28(3) requires and that EDPB Guidelines 07/2020 expect to be specific.

Annex I: Processing Details

Field	Example for a SaaS product
Subject matter	Providing the [Product] customer support analytics service
Duration	The term of the Agreement plus the return or deletion period
Nature and purpose	Hosting, storing, analyzing and displaying customer-submitted data to deliver the Services
Categories of data subjects	Customer's employees, contractors and end users
Types of personal data	Names, work email addresses, user IDs, support ticket content, usage logs
Special categories	None. Customer will not submit special category data without prior written agreement
Frequency	Continuous for the term
Retention	Until deletion under Clause 8

Annex II: Technical and Organizational Security Measures

Each row should name a control a reviewer can check. Do not copy a long list from another document, and do not invent numbers.

Area	What to state
Access control	Role-based access, MFA for production, access reviews [quarterly]
Encryption	Encryption in transit and at rest for customer data
Logging	Production access and administrative actions logged and retained for [period]
Vulnerability management	Scanning and patching process with defined owners
Backup and recovery	Backups [frequency], restore tested [frequency]
Incident response	Documented plan, tested [frequency], named contact
Personnel	Confidentiality commitments, security training at onboarding and [annually]
Vendor management	Sub-processors reviewed before engagement and [annually]

Annex III: Approved Sub-Processors

Name	Service	Data touched	Location	Transfer mechanism
[Cloud host]	Hosting and storage	All customer data	[Region]	[See Annex IV or not applicable]
[Email provider]	Transactional email	Names, email addresses	[Region]	[See Annex IV or not applicable]
[Support tool]	Support tickets and chat	Ticket content, contact details	[Region]	[See Annex IV or not applicable]
[AI or LLM API provider]	Features that process customer content	Content submitted to the feature	[Region]	[See Annex IV or not applicable]

Annex IV points to the transfer mechanism and carries nothing else. The Commission's own controller-to-processor clauses use four annexes: list of parties, description of the processing, technical and organizational measures, and a list of sub-processors. The PDF follows the same pattern and adds the transfer pointer as a fourth.

Free Data Processing Agreement Template for SaaS: A DPA Template You Can Download

This DPA template is built for a SaaS company acting as processor It works as a GDPR data processing agreement template for customers in the EU and the UK.

It contains the full customer-facing agreement with the ten clauses above in filled sample wording, Annexes I to IV, a vendor-side checklist for the agreements you sign as controller, a changes log, and a one-page customization checklist. Brackets mark every value you set. The bracketed ranges for breach hours, notice days and deletion windows are examples, and the PDF says plainly that Article 28 sets none of them.

Data Processing Agreement Example: The Sample Clauses at a Glance

Clause	The sentence that matters	Your decision
1 Subject matter	Annex I describes the processing	None, fill Annex I
2 Instructions	No processing for [Company]'s own purposes	Allow secondary use or not
3 Security	Measures in Annex II, not reduced	Which report you reference
4 Sub-processors	General authorization with notice and objection	Notice and objection days
5 Assistance	Forward requests, do not answer	Free or charged
6 Breach	Without undue delay and within [hours]	The number of hours
7 Audit	Report first, audit second	Frequency, notice, cost
8 Deletion	Return or delete at the controller's choice	Windows and backups
9 Transfers	Mechanism in Annex IV prevails	Which mechanism
10 Liability	Commercial, not set by Article 28	Cap and law

How to Fill in the Data Processing Agreement Template: Five Steps

1. Confirm the roles and the direction. Decide whether this is a customer-facing DPA (you are processor) or a vendor-facing one (you are controller, or processor engaging a sub-processor).
2. Write Annex I from your data map. List the data types, data subjects and purposes the product actually handles.
3. Write Annex II from the controls you run. Pull each row from your own policies, not from another company's template.
4. List sub-processors from your vendor inventory and set the notice rule. The inventory is the source for Annex III.
5. Pick the transfer mechanism and point to it, then get counsel review and sign. Replace every bracket, delete clauses that do not describe your practice, and keep the executed copy with the master agreement.

Negotiating a Data Processing Agreement Template With Enterprise Customers

The question is not whose paper it is. The real question is which clauses are fixed and what you offer on the rest.

Their paper or yours. EDPB Guidelines 07/2020 (paragraphs 108 to 110) say a service provider drafting the contract is not in itself a problem, that a small controller's weak bargaining position does not justify accepting terms that break data protection law, and that a controller who freely accepts the terms carries responsibility for compliance. The practical result: offer your standard DPA to every customer, and keep custom redlines for deals that justify the time.

That is the same split the Hacker News reply above described.

The table below shows where the negotiation usually lives. The positions are commercial choices, not market statistics.

Clause	A customer may ask for	A reasonable default	A sensible fall-back	Hold the line on
Breach notice	A short fixed window, such as 24 hours	[48 to 72] hours after awareness	A shorter window for confirmed incidents affecting their data	Never promise a window you cannot meet
Audit	On-site audit at any time	Report first, one audit a year on notice	Audit after a breach or regulator request	No unlimited access to shared infrastructure
Sub-processors	Specific approval for every change	General authorization with [15 to 30] days' notice	Right to object and terminate the affected service	No veto that blocks you from running a shared platform
Deletion	Immediate deletion everywhere	[30 to 90] days, backups on the next cycle	A written certificate on request	No promise to delete from backups faster than they rotate
Liability	Uncapped data protection liability	Within the master agreement cap	A higher super-cap for data protection claims	No uncapped liability
AI and secondary use	No use of their data to train models	No secondary use of customer content	Opt-in for defined product improvement	Do not hide secondary use in the terms of service

Before conceding any row, run one operational test: could your team actually do it on a Sunday?

Decision tree:

• If the customer's DPA covers every Article 28 item and the commercial terms are workable, sign theirs.
• If it is incomplete or has terms you cannot meet, send yours.
• Otherwise, attach a short addendum covering only the gaps, and keep the master agreement as the order of precedence.

Signing, Storing and Updating Your Data Processing Agreement Template Over Time

Signing is the easy part. Article 28(9) accepts electronic form, so a countersigned PDF, an e-signature or a click-through that incorporates the DPA by reference all work, as long as you can show who agreed and when. The signatories are people with authority to bind each company, usually a legal officer or an executive, not whoever received the email.

A DPA goes stale quietly. These events should trigger a review:

• A new sub-processor, or a change in an existing one
• A new type of personal data or a new category of data subject
• A new hosting region
• A product feature that changes the purposes of processing, including an AI feature that reads customer content
• A change in the transfer mechanism
• A customer renegotiation that sets a precedent for others

Give the DPA one owner, keep a change log, send sub-processor change notices on the schedule the contract promises, and keep a register of every executed DPA with its version and date. For SOC 2 and ISO 27701, auditors tend to look for the vendor management and privacy evidence around this document, such as contract reviews, a current sub-processor list and a vendor assessment trail. ComplyJet's ISO 27701 guide shows where that evidence sits.

Data Processing Agreement Template Mistakes to Avoid

Each of these is easy to make and each shows up in a customer review:

• Leaving the annexes as placeholders. A DPA with a blank Annex II is a signature on a blank page.
• Calling 72 hours the processor's deadline. It is the controller's deadline to the authority. The processor notifies without undue delay, plus whatever the contract adds.
• A sub-processor list nobody maintains. If the list on the page and the list in Annex III disagree, the customer's reviewer will find it.
• No instruction to flag an infringing instruction. Article 28(3) requires it, and the contract should say what happens next.
• Hiding secondary use in the terms of service. If product improvement or model training uses customer content, say so in the DPA and Annex I, or do not do it.
• Naming a transfer mechanism in the body and omitting it from the annex. The body and the annex should agree.
• Changing the public DPA URL and calling it notice. EDPB Guidelines 07/2020 say publication on a website alone is not compliant for changes to a processor's standard DPA terms.

How ComplyJet Helps You Run Your Data Processing Agreements

ComplyJet supports GDPR as a framework, with AI-assisted policy drafting, policy distribution with acknowledgement tracking, and evidence collection for audits. Its vendor risk management product builds a vendor inventory from your connected tools and maintains a GDPR sub-processor list from that inventory, which gives you the source for Annex III and a current list to point customers to. We also support SOC 2 and ISO 27001, the reports you can offer first on the audit ladder.

To be precise about scope: ComplyJet does not draft, negotiate or e-sign contracts, does not track executed DPAs as a feature, and is not a legal advisor. Counsel handles the agreement. We handle the program around it.

FAQs

What Is a Data Processing Agreement?

A data processing agreement is the written contract between a controller and a processor that GDPR Article 28 requires. It sets out what the processor may do with the personal data, the security and sub-processor rules, and what happens on a breach, an audit and at the end of the service. It sits alongside the master services agreement.

Is a Data Processing Agreement Required Under GDPR?

Yes, wherever one party processes personal data on behalf of another. Article 28(3) says processing by a processor shall be governed by a contract, and Article 28(9) requires it to be in writing, including electronic form. It is the relationship that triggers the requirement, not a company's size.

Who Needs a Data Processing Agreement?

Every controller that hands personal data to a processor, and every processor that engages a sub-processor. A SaaS company usually needs one with each customer, where it is the processor, and one with each vendor that handles customer data.

What Is the Difference Between a DPA and a Privacy Policy?

A privacy policy is a public notice that tells people how you handle their data as controller. A DPA is a private contract between two companies that governs how a processor handles data for a controller. The privacy policy informs. The DPA binds.

What Is the Difference Between a DPA and Standard Contractual Clauses?

A DPA covers the controller and processor relationship under Article 28. Transfer SCCs cover moving personal data outside the EU or UK. The Commission says Modules Two and Three of the transfer SCCs already include Article 28 requirements, so parties using them do not need a separate Article 28 contract for that transfer, though most still sign a full DPA.

Do I Need a DPA With Every Vendor?

You need one with every vendor that processes personal data on your behalf. A vendor that never touches personal data, such as a pure accounting tool with no customer data, does not need one. Check the vendor inventory by data type, not by vendor name, and ask for the DPA before any data flows.

How Fast Must a Processor Notify a Data Breach?

Article 33(2) says without undue delay after becoming aware. It sets no number of hours. The 72 hours in Article 33(1) is the controller's deadline to notify the authority. Parties often agree a specific window in the contract, and the figure is a commercial choice.

Do I Need a Data Processing Agreement for CCPA?

California requires a written contract with a service provider or contractor that includes specific terms under 11 CCR 7051, such as no selling or sharing and specified business purposes. It is not called a DPA, but a short California paragraph in your DPA usually satisfies it.

Can I Use My Own DPA Instead of the Customer's?

Often, yes. EDPB Guidelines 07/2020 say a supplier's standard terms are not in themselves a problem, but the controller must evaluate them and carries responsibility for accepting them. Offer yours first. If the customer insists on theirs, check it against the ten clauses and negotiate only the commercial terms.

Who Signs a Data Processing Agreement?

A person with authority to bind each company, such as a legal officer or an executive. Electronic signatures work, and a DPA can also be incorporated into the master agreement by reference. Keep the executed version with the date and version number.

Related Reading

• GDPR Compliance Requirements: the full set of obligations behind Article 28
• GDPR Breach Notification: the controller-side process that the breach clause supports
• Vendor Management Policy Template: the internal policy that tells staff to collect the DPA
• Third-Party Risk Management Policy: due diligence on the sub-processors you list
• Cross-Border Data Transfer Requirements: modules, adequacy and assessments for Annex IV
• CCPA Compliance Guide: California's rules beyond the service provider contract
• ISO 27701 Guide: where privacy and vendor evidence shows up in an audit