What is a Data Processing Agreement (DPA)?

A DPA is a legally binding contract between a data controller and a data processor that governs how personal data is processed. Under GDPR Article 28, any processing of personal data on behalf of a controller requires a written DPA.

When do I need a DPA?

You need a DPA whenever you use a third-party service that processes personal data on your behalf (cloud hosting, email services, analytics, CRM, payment processors, etc.). Both the controller and processor must sign a DPA before processing begins.

What's the difference between a data controller and data processor?

A data controller determines the purposes and means of processing personal data. A data processor processes data on behalf of the controller. For example, if you use AWS to host customer data, you're the controller and AWS is the processor.

What must a GDPR-compliant DPA include?

Under Article 28(3), a DPA must specify: subject matter, duration, nature and purpose of processing, type of personal data, categories of data subjects, and the controller's obligations and rights. It must also address sub-processing, security, breach notification, and data subject rights.

What are Standard Contractual Clauses (SCCs)?

SCCs are pre-approved contract terms issued by the European Commission for transferring personal data from the EEA to countries without adequate data protection. They're required when transferring data to the US or other non-EEA countries.

Can my data processor use sub-processors?

Yes, but only with prior written authorization from the controller. The DPA must specify whether general or specific authorization is required. The processor remains liable for any sub-processor's failures to meet data protection obligations.

What security measures should be included in a DPA?

GDPR Article 32 requires appropriate technical and organizational measures including: encryption, pseudonymization, access controls, regular security testing, incident response procedures, and staff training. The specific measures depend on the risk level.

What happens if there's a data breach?

The processor must notify the controller without undue delay after becoming aware of a personal data breach. The notification should include details to help the controller meet its 72-hour notification obligation to the supervisory authority.

How long should a DPA last?

A DPA typically lasts for the duration of the processing relationship. It should specify what happens upon termination: the processor must delete or return all personal data unless legal obligations require retention.

Is this DPA template legally binding?

This generator provides a GDPR Article 28-compliant template for informational purposes. However, every business relationship is unique. Have a qualified attorney review your DPA before signing, especially for high-risk processing or international data transfers.

DPA Generator - GDPR Data Processing Agreement Template

Data Processing Agreement

Fill in the form and click Generate to create your Data Processing Agreement.

Legal Disclaimer

This DPA generator provides a template for informational purposes only and is not legal advice. Data processing agreements must be tailored to your specific business relationship and processing activities. GDPR compliance requirements vary based on the nature of processing, data types, and jurisdictions involved. We strongly recommend having a qualified data protection attorney or legal professional review and customize this agreement before signing.

Related Tools

Additional legal document generators:

DPA Generator - GDPR Data Processing Agreement Template

Data Controller Information

Data Processor Information

Processing Details

Sub-Processors & Data Transfers

Security Measures

Data Processing Agreement

Legal Disclaimer

Related Tools

Related Tools