Contract templates · Online Business & Tech
EU and UK law requires a written contract whenever one business processes personal data on another's behalf. Enterprise clients will not sign without one.
A data processing agreement (DPA) is the contract required by Article 28 of the GDPR and UK GDPR between a controller and a processor. It covers processing instructions, staff confidentiality, security, sub-processors, data subject requests, breach notification, international transfers, deletion and audits.
When you need one
- SaaS and service providers handling client personal data
- EU/UK clients asking for a DPA
Key clauses in a Data Processing Agreement
These are the clauses the template includes, and what each one does for you.
Processing instructions
Limits processing to the controller's documented instructions.
Confidentiality of personnel
Requires staff with access to be bound by confidentiality.
Security measures
Sets technical and organisational security measures.
Sub-processors
Controls the use of sub-processors and requires notice of changes.
Data subject requests
Requires the processor to help answer data subject rights requests.
Breach notification
Sets a deadline for notifying personal data breaches.
International transfers
Covers transfers outside the EU or UK, such as Standard Contractual Clauses.
Deletion and audits
Requires deletion or return of data at the end and allows audits.
Common mistakes to avoid
- Signing a DPA that does not match how data is actually processed.
- Breach notification deadlines you cannot meet.
- No transfer mechanism for US-based sub-processors.
How to use the template
Download the Word file
Buy the Data Processing Agreement template on My Contract Lawyer and download the editable .docx straight after checkout.
Fill in the brackets
Add names, dates, fees, scope and governing law, and delete optional clauses that do not apply to your deal.
Check it against local law
Rules differ between US states, the UK and EU countries, especially for employment, consumer and property contracts. Have a lawyer review high-value or unusual deals.
Sign and keep a copy
Sign on paper or with any e-signature tool, and store the final version where both sides can find it.
Get the Data Processing Agreement (DPA) template
Lawyer-drafted and ready to edit in Word, Google Docs or Pages. One-time payment of $29, no subscription, instant download from My Contract Lawyer.
Frequently asked questions
Who needs a DPA?
Any business processing personal data for another business subject to GDPR or UK GDPR, such as SaaS providers, agencies and outsourcers.
Is a DPA required in the US?
Some state laws, such as California's CPRA, require service provider contract terms with similar content.
Controller or processor?
The controller decides why and how data is processed; the processor acts on its instructions.
Related contract templates
Templates are a starting point, not legal advice, and using one does not create a lawyer-client relationship. Contract law differs between countries and states, so check the finished document against local law.