Data Processing Agreement
A GDPR Article 28-compliant Data Processing Agreement template for controllers engaging processors. Includes sub-processor provisions, security obligations, and audit rights clauses.
What's included
- Professionally drafted, legally reviewed content
- Regulation-specific guidance notes
- Placeholder fields with clear instructions
- Version control and update log
- Customisation guide included
How to use this template
- Identify whether you're the controller or the processor. The template includes both role variants — delete the role that doesn't apply to you so the DPA you send is the right one.
- Fill in Annex 1 (categories of data, categories of subjects, purposes, duration), Annex 2 (security measures) and Annex 3 (sub-processor list). The main body references these annexes extensively.
- If the processor is outside the EEA/UK, attach the EU Standard Contractual Clauses (2021 modular clauses) or the UK IDTA. The template includes a cross-reference block but not the SCCs themselves — the Commission publishes the authoritative text.
- Negotiate the audit clauses carefully. The default is one audit per year on reasonable notice; some processors push for third-party reports (SOC 2, ISO 27001) in lieu of a right to audit.
- Sign and store. The DPA plus its executed annexes is the first document a regulator asks for in a vendor-related investigation.
Download template
Free to download. Just fill in your details.
Need an automated version of this document? TruePrivacy generates and maintains compliance documents automatically as your data processing activities change.
Try TruePrivacy freeFrequently asked questions
Does the template follow EU SCC 2021?+
The main body is drafted to pair with the 2021 modular clauses. The template is not a replacement for the SCCs — you attach the SCCs separately. For UK transfers the IDTA is the equivalent.
What about controller-to-controller transfers?+
The DPA template addresses controller-to-processor. For controller-to-controller, use SCC Module 1 standalone or a bespoke joint-controller agreement — the DPA is the wrong instrument.
How do we handle sub-processors?+
Annex 3 lists the authorised sub-processors at execution. The main body includes a general authorisation to engage new sub-processors with 30 days' notice and a right for the controller to object. Keep the sub-processor list evergreen on a public page.
What's the right breach-notification clause?+
The processor must notify the controller 'without undue delay' upon becoming aware of a personal data breach. Many customers tighten this to 24 or 48 hours by contract. The template includes a 48-hour default with the GDPR 72-hour obligation the controller carries.
Does this DPA handle US state laws?+
Yes. The template includes US annexes for CCPA/CPRA (service provider clauses), Virginia VCDPA, Colorado CPA and Connecticut CTDPA. Keep the US annexes that apply and delete the rest.
Beyond templates: automated compliance
Static templates are a start. TruePrivacy keeps your privacy documentation accurate and up to date automatically.
Free 14-day trial · No credit card required · Setup in minutes