Data Processing Agreement Template
Drop your document here and sign it now. PDF, Word and Excel all work: a .docx or .xlsx is laid out in your browser exactly as it was written, so there is nothing to convert first. Add a signature, a date, a company stamp or a watermark, then download it sealed. Free to start, no account, and the file is never uploaded to open it.
GDPR-aligned DPA between data controller and processor.
Use this free data processing agreement template to create, fill in and sign a data processing agreement online. Send to the other party for a legally binding signature, tamper-evident audit trail included.
Use this Data Processing Agreement template →
How to use the Data Processing Agreement template
- Open the template, Open the Data Processing Agreement template, the fields are laid out and ready, so you don't start from a blank page.
- Fill in your details, Type in the names, dates and terms. Adjust any wording to fit your situation; the layout updates as you go.
- Send for signature, Add the other party's email and send it for a legally binding e-signature, with a tamper-evident audit trail.
Template preview
DATA PROCESSING AGREEMENT
This Data Processing Agreement ("DPA") forms part of the agreement between [controller name] ("Controller") and [processor name] ("Processor") dated [date]. It governs Processor’s processing of Personal Data on Controller’s behalf.
1. Subject Matter & Purpose
Processor will process Personal Data only to provide the services described in the underlying agreement, on Controller’s documented instructions, and for the purposes of: [processing purpose].
2. Categories of Data & Data Subjects
Categories of Personal Data: [data categories]. Categories of Data Subjects: [subject categories].
3. Processor Obligations
Processor will: (a) process Personal Data only on documented Controller instructions; (b) ensure persons authorized to process the data are under confidentiality obligations; (c) implement appropriate technical and organizational security measures; (d) assist Controller with data subject requests and DPIAs.
4. Sub-processors
Processor may engage sub-processors only with Controller’s prior written consent (general or specific). Processor remains liable for sub-processor compliance. Current sub-processors: [subprocessors].
5. International Transfers
Any transfer of Personal Data to a country outside the EEA requires an appropriate transfer mechanism (Standard Contractual Clauses, adequacy decision, or other lawful basis).
6. Security & Breach Notification
Processor will notify Controller of any Personal Data Breach without undue delay, and in any event within 72 hours of becoming aware. Notification includes nature, categories affected, likely consequences, and mitigation measures.
7. Return / Deletion
On termination of services, Processor will return or delete all Personal Data, at Controller’s choice, unless retention is required by law.
Frequently asked questions
Is this Data Processing Agreement template free?
Yes. You can open, fill in and try the data processing agreement template for free, no account needed to start.
Is a signed data processing agreement legally binding?
Yes. Signatures made with PDF Verified comply with the US ESIGN Act, eIDAS (EU), UETA and equivalent e-signature laws in 190+ countries, and every signed document carries a tamper-evident SHA-256 seal and audit trail.
Can I edit the Data Processing Agreement template?
Yes. The template is a starting point, change any text, add or remove fields, and place signature, date or stamp fields wherever you need them.
Do I need an account?
You can start filling it in right away. An account is only needed to send for signature, save, or download the sealed copy.
What PDF Verified is, and what it is not
Electronic signature law is settled in broad terms and specific in the details. The ESIGN Act, UETA, eIDAS and their equivalents recognise electronic signatures across more than 190 countries, and what decides a particular case is intent to sign plus evidence connecting the signature to the signer, which is what the audit certificate records. Certain document types carry their own formalities wherever you are: deeds, wills, some property instruments, and anything requiring a witness or a notary. Sign only what you are authorised to sign, since applying another person signature without their authority is forgery whatever tool is used.
PDF Verified is a tool for preparing, signing, stamping and checking documents. It is not a law firm, a compliance service or a forensic examiner, and nothing here is legal, financial or compliance advice. Requirements differ by country, by document type and by the party asking, so check what applies to your document before you rely on it, and take advice where the document matters. You are responsible for the documents you create, sign and send, and for having the authority to do so: signing or stamping in somebody else name, or as an organisation you do not represent, is forgery whatever tool is used. To the extent the law allows, we accept no liability for how a document made with this tool is used or relied on. The full position is in our terms of service.