Data Processing Agreement
This Data Processing Agreement (the "DPA") is made on Agreement date between Customer (the party that owns the data), of Customer address ("Customer"), and Provider (the party that processes the data), of Provider address ("Provider"). It forms part of Main agreement (name and date, e.g. Services Agreement dated 1 March 2026) (the "Main Agreement").
This agreement is adapted from the Common Paper Data Processing Agreement (commonpaper.com), used under CC BY 4.0.
1. Roles and scope
- Customer Personal Data means personal data that Customer gives to Provider, or that Provider collects for Customer, under the Main Agreement.
- Data Protection Law means the laws on personal data that apply to Customer Personal Data, including the EU General Data Protection Regulation (GDPR) where it applies.
- Customer is the controller of Customer Personal Data. Provider is its processor. Where Customer is itself a processor for someone else, Provider is a subprocessor and this DPA applies in the same way.
- This DPA covers all processing of Customer Personal Data by Provider. It adds to the Main Agreement.
2. Processing details
- Subject matter: Subject matter of the processing (the service the Provider supplies).
- Nature and purpose: Nature and specific purpose of the processing (e.g. hosting customer records to run the Customer's helpdesk).
- Duration: Duration of the processing (e.g. the term of the main agreement, plus the return period).
- Types of personal data: Types of personal data (e.g. names, work emails, phone numbers, support messages).
- People the data is about: Groups of people the data is about (e.g. the Customer's staff and end customers).
- Sensitive data (special categories): Sensitive data included (write None if there is none).
If Provider changes the service, it may update this list by telling Customer in writing. Provider may not add sensitive data without Customer's written consent.
3. Instructions
Provider will process Customer Personal Data only:
- to provide the service in the Main Agreement
- as this DPA and the Main Agreement say
- on Customer's other written instructions, including by email, that Provider has accepted
Provider will follow these instructions unless the law requires it to act differently. In that case, Provider tells Customer before it processes, unless the law forbids this. Provider tells Customer at once if it cannot follow an instruction, or if it thinks an instruction breaks Data Protection Law.
Customer confirms that it has the right to give Provider the data and its instructions. Customer gave all notices, got all consents, and made all disclosures that Data Protection Law requires.
4. Confidentiality of personnel
Provider lets only staff who need the data to do their work access Customer Personal Data. Each person with access is bound by a duty of confidentiality, by contract or by law, that continues after their work ends.
5. Security
Provider will protect Customer Personal Data with technical and organisational measures that suit the risk. They include these measures: Security measures (e.g. encryption in transit and at rest, multi-factor login, daily backups, access logs).
Provider will, at least:
- keep the data secure against loss, misuse, and unauthorised access
- be able to restore access to the data after an incident
- test the measures regularly and fix weaknesses
- not make the measures weaker during the term
The Provider security contact is Provider security contact (email).
6. Subprocessors
Customer approves these subprocessors: Approved subprocessors (name, country, and task for each).
Provider will not give Customer Personal Data to any other subprocessor until it has told Customer in writing at least Days of notice before a new subprocessor starts (e.g. 10) days before. The notice names the subprocessor, its country, and its task. Customer has Days the Customer has to object to a new subprocessor (e.g. 30) days after the notice to object on reasonable data protection grounds. If Customer does not object in that time, the change is approved. If Customer objects, the parties will work in good faith to solve the issue.
Provider will:
- sign a written contract with each subprocessor with the same data protection duties as this DPA
- give Customer a copy of that contract on request, with business secrets removed
- stay fully responsible for each subprocessor's acts and omissions
- tell Customer if a subprocessor fails to meet a material duty about Customer Personal Data
7. People's rights and help
If a person asks Provider about their data, Provider tells Customer promptly and does not answer without Customer's consent, unless the law requires it. Provider helps Customer answer requests to access, correct, delete, restrict, move, or object to the processing of data, using suitable technical and organisational measures.
Provider also helps Customer with data protection impact assessments, transfer impact assessments, and talks with data protection authorities, as far as the nature of the processing and the information that Provider has allow. If a court or authority asks Provider for Customer Personal Data, Provider tells Customer first where the law allows and shares only what it must.
8. Security incidents
A security incident is a breach of security that causes accidental or unlawful destruction, loss, change, disclosure of, or access to Customer Personal Data.
When Provider becomes aware of a security incident, it will:
- tell Customer without undue delay, and within Hours to tell the Customer about a breach (e.g. 48) hours at most
- give Customer the information it needs, as it becomes known: what happened, what data and people are affected, the likely effects, and the steps taken
- act quickly to contain and investigate the incident and to limit harm
Customer decides whether to tell authorities and people. Provider's notice or response is not an admission of fault or liability.
9. International transfers
Provider stores and processes Customer Personal Data only in these countries: Countries where the Provider stores or processes the data. Provider may move the data to another country only after notice under section 6 and only if it has a lawful transfer method.
If the GDPR applies to a transfer of Customer Personal Data from the European Economic Area to a country without an adequacy decision from the European Commission, the parties sign the standard contractual clauses in Decision (EU) 2021/914 (Module Two, controller to processor, or Module Three where section 1 says so). The clauses are part of this DPA. The general written authorisation option applies to subprocessors, and the notice period is the one in section 6. The clauses are governed by the law of EU member state whose law governs the standard contractual clauses (e.g. Ireland), and its courts decide disputes about them. The details in sections 2, 5, and 6 are the annexes to the clauses.
10. Audits and information
Provider will give Customer the information it reasonably needs to check that Provider follows this DPA. Provider will allow audits, including inspections, by Customer or an auditor that Customer chooses and that is bound by confidentiality.
- Provider first gives Customer its latest independent audit or security report, on a confidential basis, and answers a written security questionnaire once a year.
- If these do not answer Customer's questions, or after a security incident, Customer may carry out an on-site audit after Days of notice before an on-site audit (e.g. 30) days' notice, in working hours, without harming Provider's other customers.
- Provider may refuse access that would break its confidentiality duties or the law, or expose other customers' data.
- Provider keeps records that show it follows this DPA for 3 years after this DPA ends.
11. Return and deletion
Provider lets Customer delete Customer Personal Data while the service runs, and deletes it on request as soon as it reasonably can.
Within Days to return or delete the data after the services end (e.g. 30) days after the services end, Provider will return or delete all Customer Personal Data, as Customer chooses, and delete the copies. On request, Provider confirms the deletion in writing. If the law requires Provider to keep some data, Provider tells Customer, stops all other processing, and keeps protecting the data.
12. Liability
Each party's liability to the other under this DPA is subject to the limits and exclusions in the Main Agreement. Only the Customer that signed the Main Agreement may make claims under this DPA. This DPA does not limit any liability to a person for their data protection rights, or any liability between the parties under the standard contractual clauses.
13. Term and conflicts
This DPA starts on the date above and lasts as long as the Main Agreement. Its duties continue until Provider stops processing Customer Personal Data.
If documents conflict, the standard contractual clauses (if any) come first, then this DPA, then the Main Agreement.
14. General
- Changes to this DPA are valid only in writing signed by both parties, except for updates under sections 2 and 6.
- If a term is not valid, the rest of this DPA stays in force.
- Neither party may transfer its rights under this DPA without the other party's written consent, except to a successor of its whole business.
- Notices go to the addresses above, or to an email address that a party gives for notices.
- The parties may sign this DPA electronically and in counterparts.
15. Governing law and disputes
This DPA is governed by the laws of Governing law (country or state). The parties will first try to settle any dispute by talks for 15 days. After that, the courts of Governing law (country or state) decide the dispute. Section 9 decides disputes about the standard contractual clauses.
Signatures
Customer (the party that owns the data)
Signature: ____________________________
Date: ______________
Provider (the party that processes the data)
Signature: ____________________________
Date: ______________