Free data processing agreement

This is a free DPA or data processing agreement designed to help businesses to comply with the provisions of the UK GDPR and EU GDPR relating to contracts between controllers of personal data and processors.

The UK GDPR and the EU GDPR apply very similar requirements to these contracts. The main requirements, all reflected in this free DPA, are as follows.

Specification of processing operations - The DPA should identify the personal data that is going to be processed, the categories of data subject affected, the purposes of the processing, relevant security requirements, authorised third party disclosures and permitted international transfers.

Period of processing - The DPA should require that personal data be returned and/or deleted following the completion of the relevant services.

Instructions of the controller - The processor should be bound by the DPA to only process the personal data in accordance with the instructions of the controller.

Unlawful instructions - If an instruction of the controller relating to the processing of the data is unlawful, the processor should let the controller know in accordance with the provisions of the DPA.

Legal requirements - The processor is permitted by the DPA to process the personal data where required to do so by the relevant applicable law (e.g. UK legal requirements applying to processing happening under the UK GDPR).

Confidentiality - The processor must ensure that persons authorised to process the data are under appropriate confidentiality obligations.

Security - The DPA should require that the processor implement appropriate security measures (both technical and organisational) with respect to the data.

Assistance - The processor must, under the DPA, take appropriate measures to assist the controller with the fulfilment of the controller's obligations relating to data subject rights. The processor must also assist the controller in relation to compliance with the obligations of the controller relating to the security of processing of personal data, the notification of personal data breaches to the supervisory authority, the communication of personal data breaches to the data subject, data protection impact assessments and prior consultation in relation to high-risk processing.

Breach notification - The DPA requires that personal data breaches be notified by the processor to the controller within a pre-defined timeframe (of 72 hours or less).

information and audit - The controller is entitled to audit the processor's compliance with its obligations under the DPA. The processor must facilitate such audits, and must provide to the controller all such information as is necessary to demonstrate compliance.

This free DPA assumes that the controller and processor have entered into or will enter into a separate services agreement, covering the provision of services by the processor to the controller.

Get help with this document

• Contents
• Editor preview
• Document preview

Free data processing agreement contents

1. Definitions: definitions.
2. Credit: docular credit; free documents licensing warning.
3. Supplemental:
   Agreement
    supplements main contract; definitions in main contract; conflict between 
   Agreement
    and main contract; breach of 
   Agreement
    deemed to be breach of main contract; breach of main contract deemed to be breach of 
   Agreement
   ; termination with main contract; main contract termination.
4. Term: commencement of term; end of term.
5. Data protection: compliance with data protection laws; warranty of
   Controller
   's right to disclose personal data (GDPR); details of personal data processed by 
   the Processor
    (GDPR); purposes of processing of personal data by 
   the Processor
    (GDPR); duration of personal data processing by
   Processor
   (GDPR); personal data processed by
   Processor
   on instructions (GDPR); authorised international transfers of personal data (GDPR); informing 
   Controller
    of illegal instructions (GDPR); personal data processed by
   Processor
   as required by law (GDPR); confidentiality obligations on
   Processor
    persons processing personal data (GDPR); security of personal data processed by 
   Processor
    (GDPR); appointment of sub-processor by
   Processor
   (GDPR); authorisation for
   Processor
   to appoint sub-processors (GDPR);
   Processor
    to assist with exercise of data subject rights (GDPR);
   Processor
    to assist with compliance (GDPR); obligation to notify 
   Controller
   of personal data breach (GDPR);
   Processor
    to provide data protection compliance information (GDPR); deletion of personal data by 
   Processor
    (GDPR);
   Processor
    to allow audit (GDPR); changes to data protection law.
6. Limits upon exclusions of liability: caveats to limits of liability.
7. Termination: termination by either party without cause; termination by either party upon breach; termination upon insolvency.
8. Effects of termination: surviving provisions upon termination; termination does not affect accrued rights.
9. Notices: methods and deemed receipt of contractual notices; contact details for contractual notices; substitute contact details for notices.
10. General: no waiver; severability; variation written and signed; no assignment without written consent; no third party rights; entire agreement; governing law; exclusive jurisdiction.
11. Interpretation: statutory references; section headings not affecting interpretation; calendar month meaning; no ejusdem generis.

SCHEDULE 1 (DATA PROCESSING INFORMATION)

1. Categories of data subject: prompt for categories of data subject.
2. Types of Personal Data: prompt for types of personal data.
3. Purposes of processing: prompt for personal data processing purposes.
4. Security measures for Personal Data: prompt for security measures for personal data.
5. Sub-processors of Personal Data: prompt for identifying sub-processors of personal data.

SCHEDULE 2 (STANDARD CONTRACTUAL CLAUSES)

Prompt for standard contractual clauses.

This is a shortened preview of the editor interface; once you create your instance you'll be able to edit the full document in our online editor.

This is a shortened preview of the DOCX output; once you create your instance you'll be able to download the full document in PDF, HTML, RTF and/or DOCX (Microsoft Word) format.