Legal

GDPR Data Processing Addendum (DPA) Template

Make this proposal your own with your content, logo, and brand colors.

Use template for free Open full preview
Template preview
Scroll to explore
Data processing addendum

GDPR Data Processing Addendum

Template for controller and processor terms under GDPR, including core obligations, sub processors, audit rights, data transfers, and execution requirements.
Prepared by
[Sender.Firstname] [Sender.LastName]
[sender.company]
Prepared for
[Client.FirstName] [Client.LastName]
[Client.Company]
Processor duties

Responsibilities of the data processor

This Data Processing Agreement, referred to as the Agreement or DPA, is entered into by and between [Controller company], with its principal place of business located at [Controller state] (the Company or Data Controller), and [Processor company] with its principal place of business located at [Processor state] (the Vendor or Data Processor or Processor). Both Parties agree to be bound by the terms outlined in this Agreement.
This Data Processing Agreement serves as an addition to the Master Service Agreement (MSA) or Terms and Conditions (T&C) between the Parties. It is understood that this Agreement will adhere to the terms of the MSA.
Background
Whereas, the Company acts as the Data Controller and desires to subcontract certain services, which may involve the processing of personal data, to the Data Processor. The Parties intend to establish a data processing agreement that complies with the requirements of the General Data Protection Regulation (GDPR) and other relevant Data Protection regulations. The Parties agree to operate under the following terms:
Processor responsibilities
  1. The Data Processor agrees to maintain ongoing compliance with applicable Data Protection Laws when processing personal data.
  2. The Data Processor agrees to process personal data only in accordance with the documented instructions provided by the Company.
  3. The Data Processor will ensure that any personnel, agent, or contractor of any sub-processor who may access personal data complies with applicable data security laws in the same manner as the Data Processor.
Data processing security
  1. The Data Processor shall implement appropriate technical and organizational measures to ensure the security of the personal data it processes, reducing potential risks to an acceptable level.
  2. The Data Processor will consider specific risks related to personal data breaches and establish procedures to address and rectify any such breaches promptly.

Subprocessing

Subprocessor approval
  1. The Data Processor may not appoint any sub-processor or disclose personal data to any third-party sub-processor unless explicitly authorized in writing by the Company.
Rights of data subjects
  1. "Data Subjects" refers to individuals who provide their personal information to the Company, which is subsequently shared with the Data Processor.
  2. The Data Processor agrees to assist the Company in implementing appropriate technical and organizational measures to respond to Data Subjects' requests in accordance with applicable Data Protection Laws.
  3. The Data Processor shall immediately notify the Company of any requests received from Data Subjects regarding personal data.
  4. The Data Processor shall refrain from responding to Data Subject requests unless explicitly authorized by the Company or required by applicable law.
Personal data breach
  1. In the event of a personal data breach that impacts the personal data of the Company, the Data Processor shall notify the Company without undue delay and provide sufficient details to enable the Company to meet its reporting obligations and inform affected Data Subjects.
  2. The Data Processor agrees to cooperate with the Company and take reasonable actions to assist with the investigation, mitigation, and resolution of the breach.
Deletion or return of personal data
  1. Upon the termination of services, the Data Processor agrees to delete all copies of the Company’s personal data within 10 business days.
  2. The Data Processor will provide written confirmation to the Company that all personal data has been deleted or returned as required.
Verification and legal terms

Audit rights

Audit rights
  1. The Data Processor agrees to provide the Company with access to all necessary information to demonstrate compliance with this Agreement. The Company may also conduct audits or inspections of the Data Processor's operations to verify compliance.
Data transfer
The Data Processor is prohibited from transferring personal data outside of the European Union (EU) or European Economic Area (EEA) unless prior written consent is obtained from the Company. If such a transfer is authorized, the Parties agree to implement standard contractual clauses or other EU-approved mechanisms to ensure personal data is adequately protected.
Confidentiality
Both Parties shall treat the terms of this Agreement and any related information regarding the other Party as confidential. Neither Party may disclose such information without the other Party's written consent unless required by law, or if the information is already publicly available.
Notices
All notices or communications under this Agreement must be delivered in writing, either by post or email, to the addresses listed at the beginning of this Agreement.
Governing law and jurisdiction
This Agreement is governed by the laws of [Jurisdiction/State/Country]. The Parties agree to submit to the non-exclusive jurisdiction of the courts located in [Location] for any disputes arising under this Agreement.

Execution and signatures

The undersigned execute this Agreement on behalf of their respective organizations.
In witness whereof, the undersigned have executed this Agreement:
[Client.State]
[Client.Company][Client.Title]
[Client.FirstName][Client.LastName]
Select date*
Client signatory
[sender.company][Sender.Title]
[Sender.Firstname][Sender.LastName]
Select date*
Provider signatory

Trusted by 1,100+ businesses that sell expertise

Evoke Strategy
Uffizio
Charge&Go
Aktiv
Story99
Scribd
Prolexity
Hero
Accenture
Vyapar
Storyboard Films
Infosys
TCS
FinoWorks Technologies
Growlity
Evoke Strategy
Uffizio
Charge&Go
Aktiv
Story99
Scribd
Prolexity
Hero
Accenture
Vyapar
Storyboard Films
Infosys
TCS
FinoWorks Technologies
Growlity

What's Included

Everything you need to create a professional proposal

Professional Design

Fully Customizable

Ready to Use

Mobile Responsive

How to Use This Template

Get started with your professional proposal in just a few simple steps

1

Choose Template

Select this template and click "Use template for free" to get started

2

Customize Content

Fill in your details, add your branding, and tailor the content to your needs

3

Send & Track

Send your proposal to clients and track when they view and approve it

Related Templates

Explore more templates in the Legal category

View All Templates

Frequently Asked Questions

Everything you need to know about using this template

Yes! All ProposalBiz templates are fully customizable. You can modify text, add your branding, adjust colors, include your logo, add or remove sections, and tailor every aspect to match your business needs and client requirements.
You can export your proposal in multiple formats including PDF, Word (DOCX), and as a shareable web link. Each format maintains your professional design and branding.
Not at all! Our templates are professionally designed and ready to use. Simply fill in your content, and the template automatically maintains professional formatting and design.
Yes! ProposalBiz includes built-in tracking that shows you when clients open your proposal, how long they spend on each section, and whether they've shared it with others.
Absolutely! All proposals include legally binding e-signature functionality. Clients can sign directly from any device without downloading or printing.

Ready to Create Your Proposal?

Start using this template now and create a professional proposal in minutes.

Use template for free Book a Demo
Free forever.
No credit card.