Data Processing Agreement
A data processing agreement (DPA) is a contract that sets out the obligations of a data processor handling personal data on behalf of a data controller, including how the data may be used, protected, and returned or deleted. Use this when a vendor will process personal data on your behalf (or you will on someone else's) and you need a signed record of each side's data-protection obligations.
What's included
A ready-to-use data processing agreement with signature fields already placed for Data Controller and Data Processor. Fill in the bracketed details (like [Company Name] or [Date]) using Docracy's built-in text editor, then send it out for signature.
This is a general template for informational purposes only and does not constitute legal advice. Consult a qualified attorney to review it for your specific situation and jurisdiction before use.
Key clauses
- Definitions of controller, processor, and personal data
- Scope and purpose of processing
- Data security measures
- Sub-processor authorization and obligations
- Data breach notification procedures
- Data return or deletion upon termination
What you'll fill in
[Data Controller Name][Data Processor Name][Description of Processing Activities][Categories of Personal Data][Categories of Data Subjects][Security Measures Required][Sub-processor Approval Process][Breach Notification Timeframe][Data Return/Deletion Deadline]Legal summary
Signing a data processing agreement obligates the processor to handle personal data only as instructed by the controller, apply specified security measures, and notify the controller of any data breach within an agreed timeframe. It also sets rules for using sub-processors and requires the processor to return or delete the data once the relationship ends.
Free for up to 2 signers, no account required. Need unlimited? Flat $10/month.
FAQ
Is this Data Processing Agreement legally binding?
Signing through Docracy uses a simple electronic signature (SES), which is legally recognized for everyday business agreements under laws like the U.S. ESIGN Act and the EU's eIDAS regulation. This is a general template, not legal advice — for high-stakes or regulated agreements, have a qualified attorney review it for your situation.
Who needs to sign this Data Processing Agreement?
This template includes signature fields for Data Controller and Data Processor — already placed, so you just fill in the details and send.
Can I edit this Data Processing Agreement before sending it?
Yes — Docracy's editor lets you edit the text, add or remove signature fields, redact sections, and reorder pages before you send it.
Do I need an account to send this Data Processing Agreement?
No — it's free for up to 2 signers with no account required. Create a free account only if you want to save it to a dashboard or reuse it later.
Try it with an AI assistant
Paste one of these into ChatGPT, Claude, or your assistant of choice:
“Explain the key risks in this Data Processing Agreement before I sign as a vendor handling customer data.”
“Generate a filled Data Processing Agreement between a SaaS provider (processor) and a business customer (controller).”
“Review this Data Processing Agreement's breach notification clause and suggest a reasonable notification timeframe.”
Why teams start with Docracy
“Docracy is a great product that I have tested and am using. It is easy to use, has good tools, is always up to date, and implements new features. Highly recommended.”— DACH Advisory
Free for up to 2 signers, no account required. Need unlimited? Flat $10/month.