Data Processing Agreement Template
GDPR-aligned DPA between data controller and processor.
Use this free data processing agreement template to create, fill in and sign a data processing agreement online. Send to the other party for a legally binding signature — tamper-evident audit trail included.
Use this Data Processing Agreement template →
How to use the Data Processing Agreement template
- Open the template — Open the Data Processing Agreement template — the fields are laid out and ready, so you don't start from a blank page.
- Fill in your details — Type in the names, dates and terms. Adjust any wording to fit your situation; the layout updates as you go.
- Send for signature — Add the other party's email and send it for a legally binding e-signature, with a tamper-evident audit trail.
Template preview
DATA PROCESSING AGREEMENT
This Data Processing Agreement ("DPA") forms part of the agreement between [controller name] ("Controller") and [processor name] ("Processor") dated [date]. It governs Processor’s processing of Personal Data on Controller’s behalf.
1. Subject Matter & Purpose
Processor will process Personal Data only to provide the services described in the underlying agreement, on Controller’s documented instructions, and for the purposes of: [processing purpose].
2. Categories of Data & Data Subjects
Categories of Personal Data: [data categories]. Categories of Data Subjects: [subject categories].
3. Processor Obligations
Processor will: (a) process Personal Data only on documented Controller instructions; (b) ensure persons authorized to process the data are under confidentiality obligations; (c) implement appropriate technical and organizational security measures; (d) assist Controller with data subject requests and DPIAs.
4. Sub-processors
Processor may engage sub-processors only with Controller’s prior written consent (general or specific). Processor remains liable for sub-processor compliance. Current sub-processors: [subprocessors].
5. International Transfers
Any transfer of Personal Data to a country outside the EEA requires an appropriate transfer mechanism (Standard Contractual Clauses, adequacy decision, or other lawful basis).
6. Security & Breach Notification
Processor will notify Controller of any Personal Data Breach without undue delay, and in any event within 72 hours of becoming aware. Notification includes nature, categories affected, likely consequences, and mitigation measures.
7. Return / Deletion
On termination of services, Processor will return or delete all Personal Data, at Controller’s choice, unless retention is required by law.
Frequently asked questions
Is this Data Processing Agreement template free?
Yes. You can open, fill in and try the data processing agreement template for free — no account needed to start.
Is a signed data processing agreement legally binding?
Yes. Signatures made with PDF Verified comply with the US ESIGN Act, eIDAS (EU), UETA and equivalent e-signature laws in 190+ countries, and every signed document carries a tamper-evident SHA-256 seal and audit trail.
Can I edit the Data Processing Agreement template?
Yes. The template is a starting point — change any text, add or remove fields, and place signature, date or stamp fields wherever you need them.
Do I need an account?
You can start filling it in right away. An account is only needed to send for signature, save, or download the sealed copy.